diff --git a/src/main/java/demo/security/servlet/Insecure.java b/src/main/java/demo/security/servlet/Insecure.java
index ebda03fe..cd5e35a1 100644
--- a/src/main/java/demo/security/servlet/Insecure.java
+++ b/src/main/java/demo/security/servlet/Insecure.java
@@ -8,8 +8,8 @@
 import java.security.KeyPairGenerator;
 import java.security.NoSuchAlgorithmException;
 import java.sql.Connection;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
-import java.sql.Statement;
 
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
@@ -34,18 +34,21 @@ public void badFunction(HttpServletRequest request) throws IOException {
 
   public String taintedSQL(HttpServletRequest request, Connection connection) throws Exception {
     String user = request.getParameter("user");
-    String query = "SELECT userid FROM users WHERE username = '" + user  + "'";
-    Statement statement = connection.createStatement();
-    ResultSet resultSet = statement.executeQuery(query);
+    String query = "SELECT userid FROM users WHERE username = ?";
+    PreparedStatement statement = connection.prepareStatement(query);
+    statement.setString(1, user);
+    ResultSet resultSet = statement.executeQuery();
     return resultSet.getString(0);
   }
   
   public String hotspotSQL(Connection connection, String user) throws Exception {
-	  Statement statement = null;
-	  statement = connection.createStatement();
-	  ResultSet rs = statement.executeQuery("select userid from users WHERE username=" + user);
-	  return rs.getString(0);
-	}
+    try (PreparedStatement statement = connection.prepareStatement("select userid from users WHERE username=?")) {
+      statement.setString(1, user);
+      try (ResultSet rs = statement.executeQuery()) {
+        return rs.getString(0);
+      }
+    }
+  }
 
   // --------------------------------------------------------------------------
   // Custom sources, sanitizer and sinks example
diff --git a/src/main/java/demo/security/servlet/UserServlet.java b/src/main/java/demo/security/servlet/UserServlet.java
index 154835bb..788c8a95 100644
--- a/src/main/java/demo/security/servlet/UserServlet.java
+++ b/src/main/java/demo/security/servlet/UserServlet.java
@@ -32,6 +32,6 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) t
 
     @Override
     protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
-
+        // Intentionally empty: POST requests are accepted but no processing is required for this endpoint.
     }
 }
diff --git a/src/main/java/demo/security/util/DBUtils.java b/src/main/java/demo/security/util/DBUtils.java
index 2f1aca62..d3cd6371 100644
--- a/src/main/java/demo/security/util/DBUtils.java
+++ b/src/main/java/demo/security/util/DBUtils.java
@@ -51,24 +51,30 @@ public void newConnect() throws SQLException {
     }
 
     public List<String> findUsers(String user) throws Exception {
-        String query = "SELECT userid FROM users WHERE username = '" + user + "'";
-        Statement statement = connection.createStatement();
-        ResultSet resultSet = statement.executeQuery(query);
+        String query = "SELECT userid FROM users WHERE username = ?";
         List<String> users = new ArrayList<String>();
-        while (resultSet.next()) {
-            users.add(resultSet.getString(0));
+        try (PreparedStatement statement = connection.prepareStatement(query)) {
+            statement.setString(1, user);
+            try (ResultSet resultSet = statement.executeQuery()) {
+                while (resultSet.next()) {
+                    users.add(resultSet.getString(0));
+                }
+            }
         }
         sumNumbers(100);
         return users;
     }
 
     public List<String> findItem(String itemId) throws Exception {
-        String query = "SELECT item_id FROM items WHERE item_id = '" + itemId + "'";
-        Statement statement = connection.createStatement();
-        ResultSet resultSet = statement.executeQuery(query);
+        String query = "SELECT item_id FROM items WHERE item_id = ?";
         List<String> items = new ArrayList<String>();
-        while (resultSet.next()) {
-            items.add(resultSet.getString(0));
+        try (PreparedStatement statement = connection.prepareStatement(query)) {
+            statement.setString(1, itemId);
+            try (ResultSet resultSet = statement.executeQuery()) {
+                while (resultSet.next()) {
+                    items.add(resultSet.getString(0));
+                }
+            }
         }
         return items;
     }