Switches from method argument input to the class name and also uses the parameterized query instead of string concatenation which should clear up any potential SQL injection issues.