Apple has surely muddied the waters with all this.
Go to Oracle's web site
here and download and install first the JRE (Java Runtime) and then the JDK (Java Development Kit). (see screenshot)
This will get you Java 7 and will overwrite the Java 6 web plugin that Apple installed. You can verify this by going to
this site where it will display the Java plugin version you are running. If you are not using any sites now that need the Java plugin you can just uncheck Enable Java in the security tab of Safari preferences. Or you can just leave it checked and the plugin will disable itself if you have not used it lately.
Next start the Java Preferences app from /Applications/Utilities and drag Java 7 to the top of the list like in my screenshot. This will make locally run Java applications use Java 7 instead of Java 6. You can uncheck the Java 6 options if you do not want them to be allowed to run. This section is for the Java runtime for local applications, and has nothing to do with the web plugin.
The Java web plugin is the source of the security issues, and by installing Java 7 you have overwritten the Apple supplied Java 6 plugin. Hopefully Oracle does a better job keeping Java 7 up to date.