For a Java Applet the proxy details can be set via the Java Control Panel.
Configure Proxies through the Java Control Panel
In the Java Control Panel, under the General tab, click on Network Settings.
Select the Use Browser Settings checkbox.
Click OK to save your changes.
Network Settings for the ...
Yes, your filtering on userinput2 is insufficient, the use of a single quote is not necessary for exploitation with that syntax. I didn't analyse the code any further. "Blacklisting" characters is not a reliable defense against SQL injection. You should alter the code to use parameterized queries instead.
This isn't even remotely close to safe. There are any number of gotchas:
As pointed out by Anders in a comment, this can be easily bypassed by injecting in \'. This works because it escapes your backslash, turning it into a literal backslash and causing the single quote to become unescaped. Moreover, this is actually a very common thing to attempt ...