sql注入绕过求解

对于输入userPin做了如下处理：
userPin = userPin.replaceAll("\\\\", "\\\\\\\\").replaceAll("'", "");
userPin = java.net.URLDecoder.decode(userPin.replaceAll("\\\\\\\\x", "%"), "UTF-8");
SQL语句为："SELECT userName FROM users WHERE userPin = '" + userPin + "'"外面用的conn.prepareStatement方法传参
请问该如何绕过？