CVE-2014-125047: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability classified as critical has been found in tbezman school-store. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 2957fc97054216d3a393f1775efd01ae2b072001. It is recommended to apply a patch to fix this issue. The identifier VDB-217557 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-06T12:15Z
Repository: https://github.com/tbezman/school-store
Language: Java
Files changed: src/com/bezman/background/DailySubmission.java, src/com/bezman/servlet/Attendance.java, src/com/bezman/servlet/DailyServlet.java, src/com/bezman/servlet/IndexServlet.java, src/com/bezman/servlet/ItemRecapServlet.java, src/com/bezman/servlet/ItemSettings.java, src/com/bezman/servlet/Login.java, src/com/bezman/servlet/MonthlyRecapServlet.java, src/com/bezman/servlet/StudentSettingsServlet.java, src/com/bezman/servlet/SubmitDaily.java
Commit date: 2014-11-23 19:18:29 -0500
Commit message: SQL Injection

Changed all of the SQL Queries to be safe from SQL Injeection

Diff: diff --git a/src/com/bezman/background/DailySubmission.java b/src/com/bezman/background/DailySubmission.java
index 0d86bad..5b0b4aa 100644
--- a/src/com/bezman/background/DailySubmission.java
+++ b/src/com/bezman/background/DailySubmission.java
@@ -2,10 +2,11 @@ package com.bezman.background;
 
 import com.bezman.servlet.IndexServlet;
 import org.json.simple.JSONArray;
 import org.json.simple.JSONObject;
 
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Timestamp;
 import java.util.ArrayList;
 
@@ -114,11 +115,15 @@ public class DailySubmission {
 
         Timestamp date = resultSet.getTimestamp("date");
 
         String sales = "";
 
-        ResultSet salesSet = IndexServlet.execQuery("select * from sales where date='" + date + "'");
+        PreparedStatement statement = IndexServlet.connection.prepareStatement("select * from sales where date=?");
+        statement.setTimestamp(1, date);
+
+        ResultSet salesSet = statement.executeQuery();
+
         while(salesSet.next()){
             sales += salesSet.getString("sale") + ",";
         }
 
         return new DailySubmission(startOnes, startFives, startTens, startTwenties, startPennies, startNickels, startDimes, startQuarters, endOnes, endFives, endTens, endTwenties, endPennies, endNickels, endDimes, endQuarters, startSum, endSum, names, period, sales, date, startChecks, endChecks);
diff --git a/src/com/bezman/servlet/Attendance.java b/src/com/bezman/servlet/Attendance.java
index 48e7e56..b30237b 100644
--- a/src/com/bezman/servlet/Attendance.java
+++ b/src/com/bezman/servlet/Attendance.java
@@ -6,12 +6,12 @@ import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
 
-import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.util.ArrayList;
 import java.util.Calendar;
 import java.util.List;
@@ -43,11 +43,16 @@ public class Attendance {
         JSONArray jsonArray = new JSONArray();
 
         System.out.println(month + "/ " + day + "/ " + year);
 
         try {
-            ResultSet resultSet = IndexServlet.execQuery("select * from daily where MONTH(date)='" + month + "' and DAY(date)='" + day + "' and YEAR(date)='" + year + "' order by period");
+            PreparedStatement statement = IndexServlet.connection.prepareStatement("select * from daily where MONTH(date)=? and DAY(date)=? and YEAR(date)=? order by period");
+            statement.setString(1, month);
+            statement.setString(2, day);
+            statement.setString(3, year);
+
+            ResultSet resultSet = statement.executeQuery();
 
             while(resultSet.next()){
                 jsonArray.add(resultSet.getString("names") + ";" + resultSet.getString("period"));
             }
         } catch (SQLException e) {
@@ -59,31 +64,11 @@ public class Attendance {
 
 
     @RequestMapping(value = "/attendance", method = {RequestMethod.GET})
     public String getAttendance(Model model, HttpServletRequest request, @RequestParam(value = "month", required = false) String month, @RequestParam(value = "day", required = false) String day, @RequestParam(value = "year", required = false) String year) {
 
-        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
-        if (cookie != null){
-            try {
-                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
-                String username = null;
-
-                while(resultSet.next()){
-                    model.addAttribute("username", resultSet.getString("username"));
-                    username = resultSet.getString("username");
-                }
-
-                System.out.println("Username : " + username);
-                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");
-
-                while(accountSet.next()){
-                    model.addAttribute("role", accountSet.getString("role"));
-                }
-            } catch (SQLException e) {
-                e.printStackTrace();
-            }
-        }
+        IndexServlet.servletLoginCheck(model, request);
 
         model.addAttribute("namesJSON", getAttendanceJSON(model, request, month, day, year));
 
         return "attendance";
     }
diff --git a/src/com/bezman/servlet/DailyServlet.java b/src/com/bezman/servlet/DailyServlet.java
index 3ade17f..397da92 100644
--- a/src/com/bezman/servlet/DailyServlet.java
+++ b/src/com/bezman/servlet/DailyServlet.java
@@ -8,12 +8,12 @@ import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
 
-import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.util.Comparator;
 
 /**
@@ -24,44 +24,28 @@ import java.util.Comparator;
 public class DailyServlet {
 
     @RequestMapping(value = "/daily", method = RequestMethod.GET)
     public String getDaily(Model model, HttpServletRequest request){
 
-        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
-        if (cookie != null){
-            try {
-                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
-                String username = null;
+        IndexServlet.servletLoginCheck(model, request);
 
-                while(resultSet.next()){
-                    model.addAttribute("username", resultSet.getString("username"));
-                    username = resultSet.getString("username");
-                }
-
-                System.out.println("Username : " + username);
-                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");
-
-                while(accountSet.next()){
-                    model.addAttribute("role", accountSet.getString("role"));
-                }
-
-                ResultSet itemSet = IndexServlet.execQuery("select * from items");
-                JSONArray jsonArray = new JSONArray();
+        try {
+            ResultSet itemSet = IndexServlet.execQuery("select * from items");
+            JSONArray jsonArray = new JSONArray();
 
-                while(itemSet.next()){
-                    JSONObject jsonObject = new JSONObject();
+            while (itemSet.next()) {
+                JSONObject jsonObject = new JSONObject();
 
-                    jsonObject.put("itemName", itemSet.getString("name"));
-                    jsonObject.put("priceOfItem", itemSet.getDouble("price"));
+                jsonObject.put("itemName", itemSet.getString("name"));
+                jsonObject.put("priceOfItem", itemSet.getDouble("price"));
 
-                    jsonArray.add(jsonObject);
-                }
-
-                model.addAttribute("itemNames", StringEscapeUtils.escapeJavaScript(jsonArray.toJSONString()));
-            } catch (SQLException e) {
-                e.printStackTrace();
+                jsonArray.add(jsonObject);
             }
+
+            model.addAttribute("itemNames", StringEscapeUtils.escapeJavaScript(jsonArray.toJSONString()));
+        }catch (SQLException e){
+            e.printStackTrace();
         }
 
         return "daily";
     }
 
@@ -70,12 +54,20 @@ public class DailyServlet {
     public String getStudents(Model model, @RequestParam(value = "period", required = false) String period){
 
         JSONArray jsonArray = new JSONArray();
 
         try {
-            String query = period == null ? "select * from students" : "select * from students where period='" + period + "' ORDER BY period ASC";
-            ResultSet resultSet = IndexServlet.execQuery(query);
+            PreparedStatement statement;
+
+            if (period == null){
+                statement = IndexServlet.connection.prepareStatement("SELECT * FROM students");
+            }else{
+                statement = IndexServlet.connection.prepareStatement("SELECT * FROM students WHERE period=? ORDER BY period ASC");
+                statement.setString(1, period);
+            }
+
+            ResultSet resultSet = statement.executeQuery();
 
             while(resultSet.next()){
                 JSONObject jsonObject = new JSONObject();
 
                 jsonObject.put("name", resultSet.getString("name"));
diff --git a/src/com/bezman/servlet/IndexServlet.java b/src/com/bezman/servlet/IndexServlet.java
index 010036b..61443a6 100644
--- a/src/com/bezman/servlet/IndexServlet.java
+++ b/src/com/bezman/servlet/IndexServlet.java
@@ -26,30 +26,11 @@ public class IndexServlet {
     public static Connection connection;
 
     @RequestMapping(value = "/",method = RequestMethod.GET)
     public String processWelcome(Model model, HttpServletRequest request){
 
-        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
-        if (cookie != null){
-            try {
-                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
-                String username = null;
-
-                while(resultSet.next()){
-                    model.addAttribute("username", resultSet.getString("username"));
-                    username = resultSet.getString("username");
-                }
-
-                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");
-
-                while(accountSet.next()){
-                    model.addAttribute("role", accountSet.getString("role"));
-                }
-            } catch (SQLException e) {
-                e.printStackTrace();
-            }
-        }
+        IndexServlet.servletLoginCheck(model, request);
 
         model.addAttribute("motd", StringEscapeUtils.escapeHtml(Reference.motd).replace("\n", "<br/>"));
 
         return "main";
     }
@@ -72,22 +53,28 @@ public class IndexServlet {
         return false;
     }
 
     public static boolean isSessionAdmin(String sessionID){
         try {
-            ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + sessionID + "'");
+            PreparedStatement sessionStatement = IndexServlet.connection.prepareStatement("SELECT * from sessions WHERE sessionID=?");
+            sessionStatement.setString(1, sessionID);
+
+            ResultSet resultSet = sessionStatement.executeQuery();
 
             String username = null;
 
             while(resultSet.next()){
                 username = resultSet.getString("username");
             }
 
             if(username == null)
                 return false;
 
-            ResultSet accountsSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");
+            PreparedStatement roleStatement = IndexServlet.connection.prepareStatement("SELECT  * from accounts where username=?");
+            roleStatement.setString(1, username);
+
+            ResultSet accountsSet = roleStatement.executeQuery();
 
             while(accountsSet.next()){
                 if (accountsSet.getString("role").equals("admin"))
                     return true;
             }
@@ -146,6 +133,35 @@ public class IndexServlet {
             }
         }
 
         return new Cookie("12", "12");
     }
+
+    public static void servletLoginCheck(Model model, HttpServletRequest request){
+        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
+        if (cookie != null){
+            try {
+                PreparedStatement statement = IndexServlet.connection.prepareStatement("SELECT  * from sessions where sessionID=?");
+                statement.setString(1, cookie.getValue());
+
+                ResultSet resultSet = statement.executeQuery();
+                String username = null;
+
+                while(resultSet.next()){
+                    model.addAttribute("username", resultSet.getString("username"));
+                    username = resultSet.getString("username");
+                }
+
+                PreparedStatement roleStatement = IndexServlet.connection.prepareStatement("SELECT * from accounts where username=?");
+                roleStatement.setString(1, username);
+
+                ResultSet accountSet = roleStatement.executeQuery();
+
+                while(accountSet.next()){
+                    model.addAttribute("role", accountSet.getString("role"));
+                }
+            } catch (SQLException e) {
+                e.printStackTrace();
+            }
+        }
+    }
 }
diff --git a/src/com/bezman/servlet/ItemRecapServlet.java b/src/com/bezman/servlet/ItemRecapServlet.java
index 8b6eb2f..115de8e 100644
--- a/src/com/bezman/servlet/ItemRecapServlet.java
+++ b/src/com/bezman/servlet/ItemRecapServlet.java
@@ -8,18 +8,16 @@ import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
 
-import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Timestamp;
-import java.util.ArrayList;
-import java.util.Comparator;
-import java.util.stream.Collectors;
+import java.util.*;
 
 /**
  * Created by Terence on 11/16/2014.
  */
 @Controller
@@ -27,30 +25,11 @@ import java.util.stream.Collectors;
 public class ItemRecapServlet {
 
     @RequestMapping(value = "/itemrecap", method = {RequestMethod.GET, RequestMethod.POST})
     public String getItemRecap(Model model, HttpServletRequest request){
 
-        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
-        if (cookie != null){
-            try {
-                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
-                String username = null;
-
-                while(resultSet.next()){
-                    model.addAttribute("username", resultSet.getString("username"));
-                    username = resultSet.getString("username");
-                }
-
-                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");
-
-                while(accountSet.next()){
-                    model.addAttribute("role", accountSet.getString("role"));
-                }
-            } catch (SQLException e) {
-                e.printStackTrace();
-            }
-        }
+        IndexServlet.servletLoginCheck(model, request);
 
         return "itemrecap";
     }
 
     @RequestMapping(value = "/itemrecapjson", method = {RequestMethod.GET, RequestMethod.POST})
@@ -61,30 +40,65 @@ public class ItemRecapServlet {
         String query = "select * from sales where ";
 
         ArrayList params = new ArrayList();
         ArrayList<ItemSale> items = new ArrayList<>();
 
-        if (month != null)
-            params.add("MONTH(date)='" + month + "' ");
+        HashMap<Integer, String> valueMap = new HashMap<>();
 
-        if (day != null)
-            params.add("DAY(date)='" + day + "' ");
+        Calendar calendar = Calendar.getInstance(TimeZone.getTimeZone("America/New_York"));
 
-        if (year != null)
-            params.add("YEAR(date)='" + year + "' ");
+        int predCount = 1;
 
-        if (month == null && day == null && year == null)
-            query = "select * from sales";
-        else query += params.stream().collect(Collectors.joining(" and "));
+        if (month != null) {
+            query += "MONTH(date)=?";
+
+            valueMap.put(predCount, month);
+
+            predCount++;
+        }
+
+        if (day != null) {
+
+            if (predCount > 1)
+                query += " and ";
+
+            query += "DAY(date)=?";
+
+            valueMap.put(predCount, day);
 
-        if (order == null)
-            order = "";
+            predCount++;
+        }
+
+        if (year != null) {
+
+            if (predCount > 1)
+                query += " and ";
+
+            query += "YEAR(date)=?";
+
+            valueMap.put(predCount, year);
+
+            predCount++;
+        }
+
+        if (month == null && day == null && year == null)
+            query = "SELECT * from sales";
 
         System.out.println(query);
 
         try {
-            ResultSet resultSet = IndexServlet.execQuery(query);
+
+            PreparedStatement statement = IndexServlet.connection.prepareStatement(query);
+
+            for(Integer integer : valueMap.keySet()){
+                statement.setString(integer, valueMap.get(integer));
+            }
+
+            System.out.println(statement.toString());
+
+
+            ResultSet resultSet = statement.executeQuery();
 
             while(resultSet.next()){
                 String sale = resultSet.getString("sale");
                 String[] saleSplit = sale.split(";");
 
diff --git a/src/com/bezman/servlet/ItemSettings.java b/src/com/bezman/servlet/ItemSettings.java
index ac5d29f..0e15045 100644
--- a/src/com/bezman/servlet/ItemSettings.java
+++ b/src/com/bezman/servlet/ItemSettings.java
@@ -8,11 +8,10 @@ import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
 
-import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 
@@ -24,31 +23,11 @@ import java.sql.SQLException;
 public class ItemSettings {
 
     @RequestMapping(value = "/itemsettings", method = {RequestMethod.GET})
     public String ItemSettings(Model model, HttpServletRequest request){
 
-        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
-        if (cookie != null){
-            try {
-                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
-                String username = null;
-
-                while(resultSet.next()){
-                    model.addAttribute("username", resultSet.getString("username"));
-                    username = resultSet.getString("username");
-                }
-
-                System.out.println("Username : " + username);
-                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");
-
-                while(accountSet.next()){
-                    model.addAttribute("role", accountSet.getString("role"));
-                }
-            } catch (SQLException e) {
-                e.printStackTrace();
-            }
-        }
+        IndexServlet.servletLoginCheck(model, request);
 
         JSONArray jsonArray = new JSONArray();
 
         try {
             ResultSet itemSet = IndexServlet.execQuery("select * from items");
diff --git a/src/com/bezman/servlet/Login.java b/src/com/bezman/servlet/Login.java
index d40bab8..5434728 100644
--- a/src/com/bezman/servlet/Login.java
+++ b/src/com/bezman/servlet/Login.java
@@ -7,10 +7,11 @@ import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
 
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletResponse;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.util.Random;
 
 /**
@@ -25,23 +26,35 @@ public class Login {
     public String login(@RequestParam("username") String username, @RequestParam("password") String password, HttpServletResponse response){
 
         JSONObject jsonObject = new JSONObject();
 
         try {
-            ResultSet resultSet = IndexServlet.execQuery("select * from accounts where username='" + username + "' and password='" + password + "'");
+            PreparedStatement statement = IndexServlet.connection.prepareStatement("select * from accounts where username=? and password=?");
+            statement.setString(1, username);
+            statement.setString(2, password);
+
+            ResultSet resultSet = statement.executeQuery();
 
             boolean foundAccount = false;
 
             while(resultSet.next()){
                 foundAccount = true;
             }
 
             if (foundAccount){
                 String sessionID = getRandomSessionID();
 
-                IndexServlet.execUpdate("delete from sessions where username='" + username + "'");
-                IndexServlet.execUpdate("insert into sessions values('" + username + "', '" + sessionID + "')");
+                PreparedStatement deleteSessions = IndexServlet.connection.prepareStatement("DELETE from sessions WHERE username=?");
+                deleteSessions.setString(1, username);
+
+                deleteSessions.executeUpdate();
+
+                PreparedStatement insertSession = IndexServlet.connection.prepareStatement("insert into sessions VALUES(?, ?)");
+                insertSession.setString(1, username);
+                insertSession.setString(2, sessionID);
+
+                insertSession.executeUpdate();
 
                 jsonObject.put("success", sessionID);
                 response.addCookie(new Cookie("sessionID", sessionID));
             }else jsonObject.put("success", "false");
         } catch (SQLException e) {
diff --git a/src/com/bezman/servlet/MonthlyRecapServlet.java b/src/com/bezman/servlet/MonthlyRecapServlet.java
index 4d246e5..6ce5779 100644
--- a/src/com/bezman/servlet/MonthlyRecapServlet.java
+++ b/src/com/bezman/servlet/MonthlyRecapServlet.java
@@ -10,15 +10,17 @@ import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
 
 import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.util.ArrayList;
 import java.util.Calendar;
 import java.util.Date;
+import java.util.HashMap;
 import java.util.stream.Collectors;
 
 /**
  * Created by Terence on 11/10/2014.
  */
@@ -26,31 +28,11 @@ import java.util.stream.Collectors;
 @RequestMapping
 public class MonthlyRecapServlet {
 
     @RequestMapping(value = "/monthlyrecap", method = {RequestMethod.GET})
     public String getMonthlyPage(Model model, HttpServletRequest request){
-        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
-        if (cookie != null){
-            try {
-                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
-                String username = null;
-
-                while(resultSet.next()){
-                    model.addAttribute("username", resultSet.getString("username"));
-                    username = resultSet.getString("username");
-                }
-
-                System.out.println("Username : " + username);
-                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");
-
-                while(accountSet.next()){
-                    model.addAttribute("role", accountSet.getString("role"));
-                }
-            } catch (SQLException e) {
-                e.printStackTrace();
-            }
-        }
+        IndexServlet.servletLoginCheck(model, request);
 
         return "monthlyrecap";
     }
 
     @RequestMapping(value = "/monthlyrecapjson", method = {RequestMethod.GET, RequestMethod.POST})
@@ -59,43 +41,71 @@ public class MonthlyRecapServlet {
         JSONArray jsonArray = new JSONArray();
 
         Calendar calendar = Calendar.getInstance();
         calendar.setTime(new Date());
 
+        HashMap<Integer, String> valueMap = new HashMap<>();
+
         String query = "select * from daily where ";
 
         ArrayList params = new ArrayList();
 
-        if(month != null)
-            params.add("MONTH(date)='" + month + "' ");
+        int predCount = 1;
+
+        if (month != null) {
+            query += "MONTH(date)=?";
+
+            valueMap.put(predCount, month);
+
+            predCount++;
+        }
+
+        if (day != null) {
+
+            if (predCount > 1)
+                query += " and ";
+
+            query += "DAY(date)=?";
+
+            valueMap.put(predCount, day);
+
+            predCount++;
+        }
+
+        if (year != null) {
+
+            if (predCount > 1)
+                query += " and ";
 
-        if(day != null)
-            params.add("DAY(date)='" + day + "' ");
+            query += "YEAR(date)=?";
 
-        if(year != null)
-           params.add("YEAR(date)='" + year +"' ");
+            valueMap.put(predCount, year);
+
+            predCount++;
+        }
 
         if (month == null && day == null && year == null)
             query = "select * from daily";
         else query += params.stream().collect(Collectors.joining(" and "));
 
         if(order == null)
             order = "";
 
         query += (" order by date " + order);
 
-        System.out.println(query);
+        try {
 
-        ResultSet resultSet = null;
+            PreparedStatement statement = IndexServlet.connection.prepareStatement(query);
 
-        try {
-            resultSet = IndexServlet.execQuery(query);
-        } catch (SQLException e) {
-            e.printStackTrace();
-        }
+            for(Integer integer : valueMap.keySet()){
+                statement.setString(integer, valueMap.get(integer));
+            }
+
+            System.out.println(statement);
+
+            ResultSet resultSet = statement.executeQuery();
 
-        try {
             while(resultSet.next()){
                 DailySubmission submission = DailySubmission.submissionFromRow(resultSet);
 
                 jsonArray.add(submission.toJson());
             }
@@ -109,12 +119,19 @@ public class MonthlyRecapServlet {
     @RequestMapping(value = "/deleteperiod", method = {RequestMethod.GET, RequestMethod.POST})
     @ResponseBody
     public String deletePeriodFromDate(@RequestParam("date") String date){
         JSONObject returnJSON = new JSONObject();
         try {
-            IndexServlet.execUpdate("delete from daily where date='" + date + "'");
-            IndexServlet.execUpdate("delete from sales where date='" + date + "'");
+            PreparedStatement deleteDaily = IndexServlet.connection.prepareStatement("DELETE from daily where date=?");
+            deleteDaily.setString(1, date);
+
+            deleteDaily.executeUpdate();
+
+            PreparedStatement deleteSales = IndexServlet.connection.prepareStatement("DELETE from sales where date=?");
+            deleteSales.setString(1, date);
+
+            deleteSales.executeUpdate();
             returnJSON.put("success", "true");
         } catch (SQLException e) {
             e.printStackTrace();
             returnJSON.put("success", "false");
         }
diff --git a/src/com/bezman/servlet/StudentSettingsServlet.java b/src/com/bezman/servlet/StudentSettingsServlet.java
index eece633..4865e51 100644
--- a/src/com/bezman/servlet/StudentSettingsServlet.java
+++ b/src/com/bezman/servlet/StudentSettingsServlet.java
@@ -7,13 +7,12 @@ import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
 
-import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
-import java.sql.ResultSet;
+import java.sql.PreparedStatement;
 import java.sql.SQLException;
 
 /**
  * Created by Terence on 11/13/2014.
  */
@@ -22,31 +21,11 @@ import java.sql.SQLException;
 public class StudentSettingsServlet {
 
     @RequestMapping(value = "/studentsettings", method = {RequestMethod.GET, RequestMethod.POST})
     public String studentSettings(Model model, HttpServletRequest request){
 
-        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
-        if (cookie != null){
-            try {
-                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
-                String username = null;
-
-                while(resultSet.next()){
-                    model.addAttribute("username", resultSet.getString("username"));
-                    username = resultSet.getString("username");
-                }
-
-                System.out.println("Username : " + username);
-                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");
-
-                while(accountSet.next()){
-                    model.addAttribute("role", accountSet.getString("role"));
-                }
-            } catch (SQLException e) {
-                e.printStackTrace();
-            }
-        }
+        IndexServlet.servletLoginCheck(model, request);
 
         return "studentsettings";
     }
 
     @RequestMapping(value = "/removestudent", method = {RequestMethod.GET, RequestMethod.POST})
@@ -54,11 +33,14 @@ public class StudentSettingsServlet {
     public String removeStudent(@RequestParam("name") String name){
 
         JSONObject jsonObject = new JSONObject();
 
         try {
-            IndexServlet.execUpdate("delete from students where name='" + name + "'");
+            PreparedStatement statement = IndexServlet.connection.prepareStatement("DELETE  from students where name=?");
+            statement.setString(1, name);
+
+            statement.executeUpdate();
             jsonObject.put("success", "true");
         } catch (SQLException e) {
             e.printStackTrace();
             jsonObject.put("success", "false");
         }
@@ -71,11 +53,15 @@ public class StudentSettingsServlet {
     public String addStudent(@RequestParam("name") String name, @RequestParam("period") String period){
 
         JSONObject jsonObject = new JSONObject();
 
         try {
-            IndexServlet.execUpdate("insert into students values('" + StringEscapeUtils.escapeHtml(name) + "', '" + StringEscapeUtils.escapeHtml(period) + "')");
+            PreparedStatement statement = IndexServlet.connection.prepareStatement("insert into students VALUES(?, ?)");
+            statement.setString(1, StringEscapeUtils.escapeHtml(name));
+            statement.setString(2, StringEscapeUtils.escapeHtml(period));
+
+            statement.executeUpdate();
             jsonObject.put("success", "true");
         } catch (SQLException e) {
             e.printStackTrace();
             jsonObject.put("success", "false");
         }
@@ -88,11 +74,17 @@ public class StudentSettingsServlet {
     public String editStudent(@RequestParam("oldName") String oldName, @RequestParam("newName") String newName, @RequestParam("oldPeriod") String oldPeriod, @RequestParam("newPeriod") String newPeriod){
 
         JSONObject jsonObject = new JSONObject();
 
         try {
-            IndexServlet.execUpdate("update students set name='" + StringEscapeUtils.escapeHtml(newName) + "',period='" + StringEscapeUtils.escapeHtml(newPeriod) + "' where name='" + oldName + "' and period='" + oldPeriod + "'");
+            PreparedStatement statement = IndexServlet.connection.prepareStatement("update students set name=?, period=? where name=? and period=?");
+            statement.setString(1, newName);
+            statement.setString(2, newPeriod);
+            statement.setString(3, oldName);
+            statement.setString(4, oldPeriod);
+
+            statement.executeUpdate();
             jsonObject.put("success", "true");
         } catch (SQLException e) {
             e.printStackTrace();
             jsonObject.put("success", "false");
         }
diff --git a/src/com/bezman/servlet/SubmitDaily.java b/src/com/bezman/servlet/SubmitDaily.java
index 328125f..a24113f 100644
--- a/src/com/bezman/servlet/SubmitDaily.java
+++ b/src/com/bezman/servlet/SubmitDaily.java
@@ -6,16 +6,16 @@ import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
 
+import java.sql.PreparedStatement;
 import java.sql.SQLException;
 import java.sql.Timestamp;
-import java.util.Calendar;
-import java.util.Map;
-import java.util.TimeZone;
+import java.util.*;
 import java.util.stream.Collectors;
+import java.util.stream.IntStream;
 
 /**
  * Created by Terence on 11/9/2014.
  */
 @Controller
@@ -23,34 +23,57 @@ import java.util.stream.Collectors;
 public class SubmitDaily {
 
     @RequestMapping(value = "/dailysubmit", method = {RequestMethod.GET, RequestMethod.POST})
     @ResponseBody
     public String submit(@RequestParam Map allParams, Model model){
-        String query = "insert into daily (date, ";
-
         JSONObject jsonObject = new JSONObject();
 
         String sales = (String) allParams.get("sale");
         allParams.remove("sale");
 
+        HashMap<Integer, String> keyMap = new HashMap<>();
+        HashMap<Integer, String> valueMap = new HashMap<>();
+
+        int i = 1;
+        for(Object obj : allParams.keySet()){
+            keyMap.put(i, (String) obj);
+            valueMap.put(i, (String) allParams.get(obj));
+            i++;
+        }
+
         Calendar calendar = Calendar.getInstance(TimeZone.getTimeZone("America/New_York"));
         Timestamp timestamp = new Timestamp(calendar.getTime().getTime());
 
-        String columnsNames = (String) allParams.keySet().stream().collect(Collectors.joining(", "));
-        query += columnsNames;
-        query += ") values('" + timestamp + "', " + (String) allParams.keySet().stream().map(a -> allParams.get(a)).collect(Collectors.joining("', '", "'", "'")) + ")";
+        String columnNames = (String) keyMap.values().stream().collect(Collectors.joining(", "));
+
+        ArrayList questionMarks = new ArrayList();
+        IntStream.range(0, allParams.size()).forEach(a -> questionMarks.add("?"));
+
+        String query = "insert into daily (date, " + columnNames + ") VALUES('" + timestamp + "', " + questionMarks.stream().collect(Collectors.joining(", ")) + ")";
 
         System.out.println("query : " + query);
 
         try {
-            IndexServlet.execUpdate(query);
+            PreparedStatement statement = IndexServlet.connection.prepareStatement(query);
+
+            for(Integer integer: valueMap.keySet()){
+                statement.setString(integer, valueMap.get(integer));
+            }
+
+            System.out.println(statement);
+
+            statement.executeUpdate();
 
             System.out.println(sales);
             for(String currentSale : sales.split(",")) {
-                query = "insert into sales values('" + timestamp + "', '" + currentSale + "')";
-                System.out.println(query);
-                IndexServlet.execUpdate(query);
+                query = "insert into sales values(?, ?)";
+
+                PreparedStatement salesStatement = IndexServlet.connection.prepareStatement(query);
+                salesStatement.setTimestamp(1, timestamp);
+                salesStatement.setString(2, currentSale);
+
+                salesStatement.executeUpdate();
             }
 
             jsonObject.put("success", "true");
         } catch (SQLException e) {
             jsonObject.put("success", "false");

Vulnerable code:         ResultSet salesSet = IndexServlet.execQuery("select * from sales where date='" + date + "'");
import javax.servlet.http.Cookie;
            ResultSet resultSet = IndexServlet.execQuery("select * from daily where MONTH(date)='" + month + "' and DAY(date)='" + day + "' and YEAR(date)='" + year + "' order by period");
        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
        if (cookie != null){
            try {
                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
                String username = null;

                while(resultSet.next()){
                    model.addAttribute("username", resultSet.getString("username"));
                    username = resultSet.getString("username");
                }

                System.out.println("Username : " + username);
                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");

                while(accountSet.next()){
                    model.addAttribute("role", accountSet.getString("role"));
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
import javax.servlet.http.Cookie;
        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
        if (cookie != null){
            try {
                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
                String username = null;
                while(resultSet.next()){
                    model.addAttribute("username", resultSet.getString("username"));
                    username = resultSet.getString("username");
                }

                System.out.println("Username : " + username);
                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");

                while(accountSet.next()){
                    model.addAttribute("role", accountSet.getString("role"));
                }

                ResultSet itemSet = IndexServlet.execQuery("select * from items");
                JSONArray jsonArray = new JSONArray();
                while(itemSet.next()){
                    JSONObject jsonObject = new JSONObject();
                    jsonObject.put("itemName", itemSet.getString("name"));
                    jsonObject.put("priceOfItem", itemSet.getDouble("price"));
                    jsonArray.add(jsonObject);
                }

                model.addAttribute("itemNames", StringEscapeUtils.escapeJavaScript(jsonArray.toJSONString()));
            } catch (SQLException e) {
                e.printStackTrace();
            String query = period == null ? "select * from students" : "select * from students where period='" + period + "' ORDER BY period ASC";
            ResultSet resultSet = IndexServlet.execQuery(query);
        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
        if (cookie != null){
            try {
                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
                String username = null;

                while(resultSet.next()){
                    model.addAttribute("username", resultSet.getString("username"));
                    username = resultSet.getString("username");
                }

                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");

                while(accountSet.next()){
                    model.addAttribute("role", accountSet.getString("role"));
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
            ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + sessionID + "'");
            ResultSet accountsSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");
import javax.servlet.http.Cookie;
import java.util.ArrayList;
import java.util.Comparator;
import java.util.stream.Collectors;
        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
        if (cookie != null){
            try {
                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
                String username = null;

                while(resultSet.next()){
                    model.addAttribute("username", resultSet.getString("username"));
                    username = resultSet.getString("username");
                }

                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");

                while(accountSet.next()){
                    model.addAttribute("role", accountSet.getString("role"));
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
        if (month != null)
            params.add("MONTH(date)='" + month + "' ");
        if (day != null)
            params.add("DAY(date)='" + day + "' ");
        if (year != null)
            params.add("YEAR(date)='" + year + "' ");
        if (month == null && day == null && year == null)
            query = "select * from sales";
        else query += params.stream().collect(Collectors.joining(" and "));
        if (order == null)
            order = "";
            ResultSet resultSet = IndexServlet.execQuery(query);
import javax.servlet.http.Cookie;
        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
        if (cookie != null){
            try {
                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
                String username = null;

                while(resultSet.next()){
                    model.addAttribute("username", resultSet.getString("username"));
                    username = resultSet.getString("username");
                }

                System.out.println("Username : " + username);
                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");

                while(accountSet.next()){
                    model.addAttribute("role", accountSet.getString("role"));
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
            ResultSet resultSet = IndexServlet.execQuery("select * from accounts where username='" + username + "' and password='" + password + "'");
                IndexServlet.execUpdate("delete from sessions where username='" + username + "'");
                IndexServlet.execUpdate("insert into sessions values('" + username + "', '" + sessionID + "')");
        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
        if (cookie != null){
            try {
                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
                String username = null;

                while(resultSet.next()){
                    model.addAttribute("username", resultSet.getString("username"));
                    username = resultSet.getString("username");
                }

                System.out.println("Username : " + username);
                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");

                while(accountSet.next()){
                    model.addAttribute("role", accountSet.getString("role"));
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
        if(month != null)
            params.add("MONTH(date)='" + month + "' ");
        if(day != null)
            params.add("DAY(date)='" + day + "' ");
        if(year != null)
           params.add("YEAR(date)='" + year +"' ");
        System.out.println(query);
        ResultSet resultSet = null;
        try {
            resultSet = IndexServlet.execQuery(query);
        } catch (SQLException e) {
            e.printStackTrace();
        }
        try {
            IndexServlet.execUpdate("delete from daily where date='" + date + "'");
            IndexServlet.execUpdate("delete from sales where date='" + date + "'");
import javax.servlet.http.Cookie;
import java.sql.ResultSet;
        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
        if (cookie != null){
            try {
                ResultSet resultSet = IndexServlet.execQuery("select * from sessions where sessionID='" + cookie.getValue() + "'");
                String username = null;

                while(resultSet.next()){
                    model.addAttribute("username", resultSet.getString("username"));
                    username = resultSet.getString("username");
                }

                System.out.println("Username : " + username);
                ResultSet accountSet = IndexServlet.execQuery("select * from accounts where username='" + username + "'");

                while(accountSet.next()){
                    model.addAttribute("role", accountSet.getString("role"));
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
            IndexServlet.execUpdate("delete from students where name='" + name + "'");
            IndexServlet.execUpdate("insert into students values('" + StringEscapeUtils.escapeHtml(name) + "', '" + StringEscapeUtils.escapeHtml(period) + "')");
            IndexServlet.execUpdate("update students set name='" + StringEscapeUtils.escapeHtml(newName) + "',period='" + StringEscapeUtils.escapeHtml(newPeriod) + "' where name='" + oldName + "' and period='" + oldPeriod + "'");
import java.util.Calendar;
import java.util.Map;
import java.util.TimeZone;
        String query = "insert into daily (date, ";

        String columnsNames = (String) allParams.keySet().stream().collect(Collectors.joining(", "));
        query += columnsNames;
        query += ") values('" + timestamp + "', " + (String) allParams.keySet().stream().map(a -> allParams.get(a)).collect(Collectors.joining("', '", "'", "'")) + ")";
            IndexServlet.execUpdate(query);
                query = "insert into sales values('" + timestamp + "', '" + currentSale + "')";
                System.out.println(query);
                IndexServlet.execUpdate(query);
Fixed code: import java.sql.PreparedStatement;
        PreparedStatement statement = IndexServlet.connection.prepareStatement("select * from sales where date=?");
        statement.setTimestamp(1, date);

        ResultSet salesSet = statement.executeQuery();

import java.sql.PreparedStatement;
            PreparedStatement statement = IndexServlet.connection.prepareStatement("select * from daily where MONTH(date)=? and DAY(date)=? and YEAR(date)=? order by period");
            statement.setString(1, month);
            statement.setString(2, day);
            statement.setString(3, year);

            ResultSet resultSet = statement.executeQuery();
        IndexServlet.servletLoginCheck(model, request);
import java.sql.PreparedStatement;
        IndexServlet.servletLoginCheck(model, request);
        try {
            ResultSet itemSet = IndexServlet.execQuery("select * from items");
            JSONArray jsonArray = new JSONArray();
            while (itemSet.next()) {
                JSONObject jsonObject = new JSONObject();
                jsonObject.put("itemName", itemSet.getString("name"));
                jsonObject.put("priceOfItem", itemSet.getDouble("price"));
                jsonArray.add(jsonObject);

            model.addAttribute("itemNames", StringEscapeUtils.escapeJavaScript(jsonArray.toJSONString()));
        }catch (SQLException e){
            e.printStackTrace();
            PreparedStatement statement;

            if (period == null){
                statement = IndexServlet.connection.prepareStatement("SELECT * FROM students");
            }else{
                statement = IndexServlet.connection.prepareStatement("SELECT * FROM students WHERE period=? ORDER BY period ASC");
                statement.setString(1, period);
            }

            ResultSet resultSet = statement.executeQuery();
        IndexServlet.servletLoginCheck(model, request);
            PreparedStatement sessionStatement = IndexServlet.connection.prepareStatement("SELECT * from sessions WHERE sessionID=?");
            sessionStatement.setString(1, sessionID);

            ResultSet resultSet = sessionStatement.executeQuery();
            PreparedStatement roleStatement = IndexServlet.connection.prepareStatement("SELECT  * from accounts where username=?");
            roleStatement.setString(1, username);

            ResultSet accountsSet = roleStatement.executeQuery();

    public static void servletLoginCheck(Model model, HttpServletRequest request){
        Cookie cookie = IndexServlet.getCookie(request.getCookies(), "sessionID");
        if (cookie != null){
            try {
                PreparedStatement statement = IndexServlet.connection.prepareStatement("SELECT  * from sessions where sessionID=?");
                statement.setString(1, cookie.getValue());

                ResultSet resultSet = statement.executeQuery();
                String username = null;

                while(resultSet.next()){
                    model.addAttribute("username", resultSet.getString("username"));
                    username = resultSet.getString("username");
                }

                PreparedStatement roleStatement = IndexServlet.connection.prepareStatement("SELECT * from accounts where username=?");
                roleStatement.setString(1, username);

                ResultSet accountSet = roleStatement.executeQuery();

                while(accountSet.next()){
                    model.addAttribute("role", accountSet.getString("role"));
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
    }
import java.sql.PreparedStatement;
import java.util.*;
        IndexServlet.servletLoginCheck(model, request);
        HashMap<Integer, String> valueMap = new HashMap<>();
        Calendar calendar = Calendar.getInstance(TimeZone.getTimeZone("America/New_York"));
        int predCount = 1;
        if (month != null) {
            query += "MONTH(date)=?";

            valueMap.put(predCount, month);

            predCount++;
        }

        if (day != null) {

            if (predCount > 1)
                query += " and ";

            query += "DAY(date)=?";

            valueMap.put(predCount, day);
            predCount++;
        }

        if (year != null) {

            if (predCount > 1)
                query += " and ";

            query += "YEAR(date)=?";

            valueMap.put(predCount, year);

            predCount++;
        }

        if (month == null && day == null && year == null)
            query = "SELECT * from sales";

            PreparedStatement statement = IndexServlet.connection.prepareStatement(query);

            for(Integer integer : valueMap.keySet()){
                statement.setString(integer, valueMap.get(integer));
            }

            System.out.println(statement.toString());


            ResultSet resultSet = statement.executeQuery();
        IndexServlet.servletLoginCheck(model, request);
import java.sql.PreparedStatement;
            PreparedStatement statement = IndexServlet.connection.prepareStatement("select * from accounts where username=? and password=?");
            statement.setString(1, username);
            statement.setString(2, password);

            ResultSet resultSet = statement.executeQuery();
                PreparedStatement deleteSessions = IndexServlet.connection.prepareStatement("DELETE from sessions WHERE username=?");
                deleteSessions.setString(1, username);

                deleteSessions.executeUpdate();

                PreparedStatement insertSession = IndexServlet.connection.prepareStatement("insert into sessions VALUES(?, ?)");
                insertSession.setString(1, username);
                insertSession.setString(2, sessionID);

                insertSession.executeUpdate();
import java.sql.PreparedStatement;
import java.util.HashMap;
        IndexServlet.servletLoginCheck(model, request);
        HashMap<Integer, String> valueMap = new HashMap<>();

        int predCount = 1;

        if (month != null) {
            query += "MONTH(date)=?";

            valueMap.put(predCount, month);

            predCount++;
        }

        if (day != null) {

            if (predCount > 1)
                query += " and ";

            query += "DAY(date)=?";

            valueMap.put(predCount, day);

            predCount++;
        }

        if (year != null) {

            if (predCount > 1)
                query += " and ";
            query += "YEAR(date)=?";
            valueMap.put(predCount, year);

            predCount++;
        }
        try {
            PreparedStatement statement = IndexServlet.connection.prepareStatement(query);
            for(Integer integer : valueMap.keySet()){
                statement.setString(integer, valueMap.get(integer));
            }

            System.out.println(statement);

            ResultSet resultSet = statement.executeQuery();
            PreparedStatement deleteDaily = IndexServlet.connection.prepareStatement("DELETE from daily where date=?");
            deleteDaily.setString(1, date);

            deleteDaily.executeUpdate();

            PreparedStatement deleteSales = IndexServlet.connection.prepareStatement("DELETE from sales where date=?");
            deleteSales.setString(1, date);

            deleteSales.executeUpdate();
import java.sql.PreparedStatement;
        IndexServlet.servletLoginCheck(model, request);
            PreparedStatement statement = IndexServlet.connection.prepareStatement("DELETE  from students where name=?");
            statement.setString(1, name);

            statement.executeUpdate();
            PreparedStatement statement = IndexServlet.connection.prepareStatement("insert into students VALUES(?, ?)");
            statement.setString(1, StringEscapeUtils.escapeHtml(name));
            statement.setString(2, StringEscapeUtils.escapeHtml(period));

            statement.executeUpdate();
            PreparedStatement statement = IndexServlet.connection.prepareStatement("update students set name=?, period=? where name=? and period=?");
            statement.setString(1, newName);
            statement.setString(2, newPeriod);
            statement.setString(3, oldName);
            statement.setString(4, oldPeriod);

            statement.executeUpdate();
import java.sql.PreparedStatement;
import java.util.*;
import java.util.stream.IntStream;
        HashMap<Integer, String> keyMap = new HashMap<>();
        HashMap<Integer, String> valueMap = new HashMap<>();

        int i = 1;
        for(Object obj : allParams.keySet()){
            keyMap.put(i, (String) obj);
            valueMap.put(i, (String) allParams.get(obj));
            i++;
        }

        String columnNames = (String) keyMap.values().stream().collect(Collectors.joining(", "));

        ArrayList questionMarks = new ArrayList();
        IntStream.range(0, allParams.size()).forEach(a -> questionMarks.add("?"));

        String query = "insert into daily (date, " + columnNames + ") VALUES('" + timestamp + "', " + questionMarks.stream().collect(Collectors.joining(", ")) + ")";
            PreparedStatement statement = IndexServlet.connection.prepareStatement(query);

            for(Integer integer: valueMap.keySet()){
                statement.setString(integer, valueMap.get(integer));
            }

            System.out.println(statement);

            statement.executeUpdate();
                query = "insert into sales values(?, ?)";

                PreparedStatement salesStatement = IndexServlet.connection.prepareStatement(query);
                salesStatement.setTimestamp(1, timestamp);
                salesStatement.setString(2, currentSale);

                salesStatement.executeUpdate();