package model;

import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.Statement;
import java.sql.PreparedStatement;
import java.sql.SQLException;

public class Keywords
{
	public static final String dbName = "jdbc:sqlite:keywords.db";
	public static final String tableName = "keywords";

	public static void setKeywords(String path, String keywords)
	{
		try {
			Connection c = DBConnection.getConnection();
			if (c == null)
				return;

			PreparedStatement statement = c.prepareStatement("insert or replace into " + tableName + " (path, keywords)"
					+ " values(?, ?)");
			statement.setQueryTimeout(10);
			statement.setString(1, path);
			statement.setString(2, keywords);
			statement.executeUpdate();
		}
		catch (Exception e) {
			System.err.println(e);
		}
	}

	public static String getkeywords(String path)
	{
		String result = "";

		try {
			Connection c = DBConnection.getConnection();
			if (c == null)
				return result;

			Statement statement = c.createStatement();
			statement.setQueryTimeout(10);

			ResultSet rs = statement.executeQuery(
					"select keywords from " + tableName + " where path = '" + path + "'");

			if (rs.next())
				result = rs.getString("keywords");
		}
		catch (Exception e) {
			System.err.println(e);
		}

		return result;
	}
}

@@ -68,35 +68,8 @@
 et;%0A
-import java.sql.Statement;%0A
 impo
@@ -455,17 +455,21 @@
 tement =
- 
+%0A%09%09%09%09
 c.prepar
@@ -539,16 +539,17 @@
 words)%22%0A
+%09
 %09%09%09%09%09+ %22
@@ -931,16 +931,24 @@
 lt;%0A%0A%09%09%09
+Prepared
 Statemen
@@ -967,13 +967,14 @@
 = c.
-creat
+prepar
 eSta
@@ -980,16 +980,110 @@
 atement(
+%0A%09%09%09%09%09%22select keywords from %22 + tableName + %22 where path = ?%22);%0A%09%09%09statement.setString(1, path
 );%0A%09%09%09st
@@ -1157,82 +1157,8 @@
 ery(
-%0A%09%09%09%09%09%22select keywords from %22 + tableName + %22 where path = '%22 + path + %22'%22
 );%0A%0A

Use prepared statement for getKeywords too