package model;

import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.Statement;
import java.sql.SQLException;

public class Keywords
{
	public static final String dbName = "jdbc:sqlite:keywords.db";
	public static final String tableName = "keywords";

	public static void setKeywords(String path, String keywords)
	{
		try {
			Connection c = DBConnection.getConnection();
			if (c == null)
				return;

			Statement statement = c.createStatement();
			statement.setQueryTimeout(10);

			statement.executeUpdate("insert or replace into " + tableName + " (path, keywords)"
					+ " values('" + path + "', '" + keywords + "')");
		}
		catch (Exception e) {
			System.err.println(e);
		}
	}

	public static String getkeywords(String path)
	{
		String result = "";

		try {
			Connection c = DBConnection.getConnection();
			if (c == null)
				return result;

			Statement statement = c.createStatement();
			statement.setQueryTimeout(10);

			ResultSet rs = statement.executeQuery(
					"select keywords from " + tableName + " where path = '" + path + "'");

			if (rs.next())
				result = rs.getString("keywords");
		}
		catch (Exception e) {
			System.err.println(e);
		}

		return result;
	}
}

@@ -91,16 +91,51 @@
 tement;%0A
+import java.sql.PreparedStatement;%0A
 import j
@@ -449,24 +449,32 @@
 return;%0A%0A%09%09%09
+Prepared
 Statement st
@@ -489,201 +489,241 @@
 = c.
-createStatement();%0A%09%09%09statement.setQueryTimeout(10);%0A%0A%09%09%09statement.executeUpdate(%22insert or replace into %22 + tableName + %22 (path, keywords)%22%0A%09%09%09%09%09+ %22 values('%22 + path + %22', '%22 + keywords + %22')%22
+prepareStatement(%22insert or replace into %22 + tableName + %22 (path, keywords)%22%0A%09%09%09%09%09+ %22 values(?, ?)%22);%0A%09%09%09statement.setQueryTimeout(10);%0A%09%09%09statement.setString(1, path);%0A%09%09%09statement.setString(2, keywords);%0A%09%09%09statement.executeUpdate(
 );%0A%09

use prepared statement