SqlInjection_content7.adoc contains:

SELECT * FROM users WHERE user = "'" + session.getAttribute("UserID") + "'";

The single quotes are ok, but the " are probably copied from the Java code and are not necessary in the documentation