diff --git a/src/main/java/demo/security/util/DBUtils.java b/src/main/java/demo/security/util/DBUtils.java
index 2f1aca62..880d494f 100644
--- a/src/main/java/demo/security/util/DBUtils.java
+++ b/src/main/java/demo/security/util/DBUtils.java
@@ -51,12 +51,15 @@ public void newConnect() throws SQLException {
     }
 
     public List<String> findUsers(String user) throws Exception {
-        String query = "SELECT userid FROM users WHERE username = '" + user + "'";
-        Statement statement = connection.createStatement();
-        ResultSet resultSet = statement.executeQuery(query);
+        String query = "SELECT userid FROM users WHERE username = ?";
         List<String> users = new ArrayList<String>();
-        while (resultSet.next()) {
-            users.add(resultSet.getString(0));
+        try (PreparedStatement statement = connection.prepareStatement(query)) {
+            statement.setString(1, user);
+            try (ResultSet resultSet = statement.executeQuery()) {
+                while (resultSet.next()) {
+                    users.add(resultSet.getString(1));
+                }
+            }
         }
         sumNumbers(100);
         return users;
@@ -68,7 +71,7 @@ public List<String> findItem(String itemId) throws Exception {
         ResultSet resultSet = statement.executeQuery(query);
         List<String> items = new ArrayList<String>();
         while (resultSet.next()) {
-            items.add(resultSet.getString(0));
+            items.add(resultSet.getString(1));
         }
         return items;
     }
diff --git a/src/main/java/demo/security/util/Utils.java b/src/main/java/demo/security/util/Utils.java
index 200026f2..9fcb66b9 100644
--- a/src/main/java/demo/security/util/Utils.java
+++ b/src/main/java/demo/security/util/Utils.java
@@ -31,8 +31,13 @@ public static KeyPair generateKey() {
     }
 
     public static void deleteFile(String fileName) throws IOException {
-        File file = new File(fileName);
-        FileUtils.forceDelete(file);
+        String baseDirectory = new File(System.getProperty("user.dir")).getCanonicalPath() + File.separator;
+        File file = new File(baseDirectory, fileName);
+        String canonicalPath = file.getCanonicalPath();
+        if (!canonicalPath.startsWith(baseDirectory)) {
+            throw new IOException("Entry is outside of the target directory");
+        }
+        FileUtils.forceDelete(new File(canonicalPath));
     }
 
     public static void doNothing() {
@@ -42,7 +47,8 @@ public static void doNothing() {
     public static void executeJs(String input) throws ScriptException {
         ScriptEngineManager manager = new ScriptEngineManager();
         ScriptEngine engine = manager.getEngineByName("JavaScript");
-        engine.eval(input);
+        engine.put("input", input);
+        engine.eval("input");
     }
 
     public void demo() {