Replace ChannelStorage.java

src/main/java/inf226/inchat/ChannelStorage.java

 package inf226.inchat;
 
-import java.sql.Connection;
-import java.sql.ResultSet;
-import java.sql.SQLException;
-import java.sql.Statement;
+import java.sql.*;
 import java.time.Instant;
 import java.util.UUID;
 import java.util.TreeMap;
@@ -86,18 +83,20 @@ public final class ChannelStorage
         }
     }
     @Override
-    public Stored<Channel> get(UUID id)
-      throws DeletedException,
-             SQLException {
+    public Stored<Channel> get(UUID id) throws DeletedException, SQLException {
 
-        final String channelsql = "SELECT version,name FROM Channel WHERE id = '" + id.toString() + "'";
-        final String eventsql = "SELECT id,rowid FROM Event WHERE channel = '" + id.toString() + "' ORDER BY rowid ASC";
+        final String channelsql = id.toString();
+        final String channelQuery = "SELECT version,name FROM Channel WHERE id = ? ";
+        final String eventsql = id + "' ORDER BY rowid ASC";
+        final String eventQuery = "SELECT id,rowid FROM Event WHERE channel = ? ";
 
-        final Statement channelStatement = connection.createStatement();
-        final Statement eventStatement = connection.createStatement();
+        final PreparedStatement channelStatement = connection.prepareStatement(channelQuery);
+        channelStatement.setString(1, channelsql);
+        final PreparedStatement eventStatement = connection.prepareStatement(eventQuery);
+        eventStatement.setString(1, eventsql);
 
-        final ResultSet channelResult = channelStatement.executeQuery(channelsql);
-        final ResultSet eventResult = eventStatement.executeQuery(eventsql);
+        final ResultSet channelResult = channelStatement.executeQuery();
+        final ResultSet eventResult = eventStatement.executeQuery();
 
         if(channelResult.next()) {
             final UUID version = 
@@ -139,10 +138,12 @@ public final class ChannelStorage
       throws DeletedException,
              SQLException {
 
-        final String channelsql = "SELECT version FROM Channel WHERE id = '" + id.toString() + "'";
-        final Statement channelStatement = connection.createStatement();
+        final String channelsql = id.toString() + "'";
+        final String channelQuery = "SELECT version FROM Channel WHERE id = ? ";
+        final PreparedStatement channelStatement = connection.prepareStatement(channelQuery);
+        channelStatement.setString(1, channelsql);
 
-        final ResultSet channelResult = channelStatement.executeQuery(channelsql);
+        final ResultSet channelResult = channelStatement.executeQuery();
         if(channelResult.next()) {
             return UUID.fromString(
                     channelResult.getString("version"));