From 35577345fba2c56ff8e7fca24d381a90a9460434 Mon Sep 17 00:00:00 2001
From: Chuck Aude <21095583+chuckaude@users.noreply.github.com>
Date: Thu, 10 Sep 2026 09:55:35 -0600
Subject: [PATCH] update file src/main/java/SqlInjection.java

---
 src/main/java/SqlInjection.java | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/main/java/SqlInjection.java b/src/main/java/SqlInjection.java
index 2b186e2f..5e6b5776 100644
--- a/src/main/java/SqlInjection.java
+++ b/src/main/java/SqlInjection.java
@@ -6,9 +6,10 @@
 public class SqlInjection {
     public static ResultSet doQuery(HttpServletRequest request, Connection connection) throws SQLException {
         String customerName = request.getParameter("customerName");
-        String query = "SELECT account_balance FROM user_data WHERE user_name = " + customerName;
-        Statement statement = connection.createStatement();
-        ResultSet results = statement.executeQuery(query);
+        String query = "SELECT account_balance FROM user_data WHERE user_name = ?";
+        PreparedStatement statement = connection.prepareStatement(query);
+        statement.setString(1, customerName);
+        ResultSet results = statement.executeQuery();
         return(results);
     }
 }