Does this PreparedStatement thing provide some form of protection against SQLinjetction out of the box. If not, is it possible to add something easily here? I know it's just a example but we should try to avoid the most obvious security relevenat errors if possible with acceptable effort.