Index: test/MaxmumDBConnection.java
===================================================================
--- test/MaxmumDBConnection.java	(revision 6594)
+++ test/MaxmumDBConnection.java	(revision 6595)
@@ -140,7 +140,7 @@
     DBConnection conn = null;
     PreparedStatement pStmt = null;
     ResultSet rs = null;
-    String sql = "select docid from xml_documents where docid like'%jing%'";
+    String sql = "select docid from xml_documents where docid like ?";
     
     try
     {
@@ -148,6 +148,7 @@
       serialNumber = conn.getCheckOutSerialNumber();
       System.out.println("serialNumber: "+serialNumber);
       pStmt = conn.prepareStatement(sql);
+      pStmt.setString(1, "%jing%");
       pStmt.execute();
       rs = pStmt.getResultSet();
       if (rs.next())
Index: src/edu/ucsb/nceas/metacat/IndexingQueue.java
===================================================================
--- src/edu/ucsb/nceas/metacat/IndexingQueue.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/IndexingQueue.java	(revision 6595)
@@ -216,6 +216,7 @@
 	        boolean inxmldoc = false;
             
 	        String revision = docid.substring(docid.lastIndexOf(".")+1,docid.length());
+	        int rev = Integer.parseInt(revision);
 	        docid = docid.substring(0,docid.lastIndexOf("."));
 
 	        logMetacat.info("Checking if document exists in xml_documents: docid is " 
@@ -228,12 +229,13 @@
 	            serialNumber = dbConn.getCheckOutSerialNumber();
 
 	            String xmlDocumentsCheck = "SELECT distinct docid FROM " + tablename
-	                        + " WHERE docid ='" + docid
-	                        + "' AND rev ='" + revision + "'";
+	                        + " WHERE docid = ? " 
+	                        + " AND rev = ?";
 
                 PreparedStatement xmlDocCheck = dbConn.prepareStatement(xmlDocumentsCheck);
+                xmlDocCheck.setString(1, docid);
+                xmlDocCheck.setInt(2, rev);
                 // Increase usage count
-	            
                 dbConn.increaseUsageCount(1);
 	            xmlDocCheck.execute();
 	            ResultSet doccheckRS = xmlDocCheck.getResultSet();
Index: src/edu/ucsb/nceas/metacat/spatial/SpatialDocument.java
===================================================================
--- src/edu/ucsb/nceas/metacat/spatial/SpatialDocument.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/spatial/SpatialDocument.java	(revision 6595)
@@ -92,11 +92,11 @@
 		 * Determine the docname/schema and decide how to proceed with spatial
 		 * harvest
 		 */
-		String query = "SELECT docname FROM xml_documents WHERE docid='" + docid.trim()
-				+ "';";
+		String query = "SELECT docname FROM xml_documents WHERE docid = ?";
 		String docname = "";
 		try {
 			pstmt = dbconn.prepareStatement(query);
+			pstmt.setString(1, docid.trim());
 			pstmt.execute();
 			rs = pstmt.getResultSet();
 			while (rs.next()) {
@@ -146,12 +146,9 @@
 			 * Get the bounding coordinates
 			 */
 			query = "SELECT path, nodedatanumerical, parentnodeid FROM xml_path_index"
-					+ " WHERE docid = '"
-					+ docid.trim()
-					+ "'"
-					+ " AND docid IN (SELECT distinct docid FROM xml_access WHERE docid = '"
-					+ docid.trim()
-					+ "' AND principal_name = 'public' AND perm_type = 'allow')"
+					+ " WHERE docid = ?"
+					+ " AND docid IN (SELECT distinct docid FROM xml_access WHERE docid = ?"
+					+ " AND principal_name = 'public' AND perm_type = 'allow')"
 					+ " AND (path = '" + westPath + "'" + "  OR path = '" + southPath
 					+ "'" + "  OR path = '" + eastPath + "'" + "  OR path = '"
 					+ northPath + "'" + " ) ORDER BY parentnodeid;";
@@ -158,6 +155,8 @@
 
 			try {
 				pstmt = dbconn.prepareStatement(query);
+				pstmt.setString(1, docid.trim());
+				pstmt.setString(2, docid.trim());
 				pstmt.execute();
 				rs = pstmt.getResultSet();
 				while (rs.next()) {
@@ -187,9 +186,11 @@
 			try {
 
 				String docTitlePath = PropertyService.getProperty("spatial.docTitle");
-				query = "select nodedata from xml_path_index where path = '"
-						+ docTitlePath.trim() + "' and docid = '" + docid.trim() + "'";
+				query = "select nodedata from xml_path_index where path = ?"
+						+ " and docid = ?";
 				pstmt = dbconn.prepareStatement(query);
+				pstmt.setString(1, docTitlePath.trim());
+				pstmt.setString(2, docid.trim());
 				pstmt.execute();
 				rs = pstmt.getResultSet();
 				if (rs.next())
Index: src/edu/ucsb/nceas/metacat/EventLog.java
===================================================================
--- src/edu/ucsb/nceas/metacat/EventLog.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/EventLog.java	(revision 6595)
@@ -27,7 +27,9 @@
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Timestamp;
+import java.util.ArrayList;
 import java.util.Date;
+import java.util.List;
 
 import org.apache.log4j.Logger;
 
@@ -112,14 +114,8 @@
         String insertString = "insert into access_log"
                 + "(ip_address, user_agent, principal, docid, "
                 + "event, date_logged) "
-                + "values ("
-                + "'" + logData.getIpAddress() + "', " 
-                + "'" + logData.getUserAgent() + "', " 
-                + "'" + logData.getPrincipal() + "', "
-                + "'" + logData.getDocid() + "', "
-                + "'" + logData.getEvent() + "', "
-                + " ? " + ")"; 
-
+                + "values ( ?, ?, ?, ?, ?, ? )";
+ 
         DBConnection dbConn = null;
         int serialNumber = -1;
         try {
@@ -129,7 +125,13 @@
             
             // Execute the insert statement
             PreparedStatement stmt = dbConn.prepareStatement(insertString);
-            stmt.setTimestamp(1, new Timestamp(new Date().getTime()));
+            
+            stmt.setString(1, logData.getIpAddress());
+            stmt.setString(2, logData.getUserAgent());
+            stmt.setString(3, logData.getPrincipal());
+            stmt.setString(4, logData.getDocid());
+            stmt.setString(5, logData.getEvent());
+            stmt.setTimestamp(6, new Timestamp(new Date().getTime()));
             stmt.executeUpdate();
             stmt.close();
         } catch (SQLException e) {
@@ -175,20 +177,53 @@
         int startIndex = 0;
         int endIndex = 0;
         
+        List<String> paramValues = new ArrayList<String>();
         if (ipAddress != null) {
-            query.append(generateSqlClause(clauseAdded, "ip_address", ipAddress));
+        	query.append("ip_address in (");
+        	for (int i = 0; i < ipAddress.length; i++) {
+        		if (i > 0) {
+            		query.append(", ");
+        		}
+        		query.append("?");
+        		paramValues.add(ipAddress[i]);
+        	}
+        	query.append(") ");
             clauseAdded = true;
         }
         if (principal != null) {
-            query.append(generateSqlClause(clauseAdded, "principal", principal));
+        	query.append("principal in (");
+        	for (int i = 0; i < principal.length; i++) {
+        		if (i > 0) {
+            		query.append(", ");
+        		}
+        		query.append("?");
+        		paramValues.add(principal[i]);
+        	}
+        	query.append(") ");
             clauseAdded = true;
         }
         if (docid != null) {
-            query.append(generateSqlClause(clauseAdded, "docid", docid));
+        	query.append("docid in (");
+        	for (int i = 0; i < docid.length; i++) {
+        		if (i > 0) {
+            		query.append(", ");
+        		}
+        		query.append("?");
+        		paramValues.add(docid[i]);
+        	}
+        	query.append(") ");
             clauseAdded = true;
         }
         if (event != null) {
-            query.append(generateSqlClause(clauseAdded, "event", event));
+        	query.append("event in (");
+        	for (int i = 0; i < event.length; i++) {
+        		if (i > 0) {
+            		query.append(", ");
+        		}
+        		query.append("?");
+        		paramValues.add(event[i]);
+        	}
+        	query.append(") ");
             clauseAdded = true;
         }
         if (startDate != null) {
@@ -216,11 +251,16 @@
 
             // Execute the query statement
             PreparedStatement stmt = dbConn.prepareStatement(query.toString());
+            //set the param values
+            int parameterIndex = 1;
+            for (String val: paramValues) {
+            	stmt.setString(parameterIndex, val);
+            }
             if (startIndex > 0) {
-                stmt.setTimestamp(startIndex, startDate); 
+                stmt.setTimestamp(parameterIndex + startIndex, startDate); 
             }
             if (endIndex > 0) {
-                stmt.setTimestamp(endIndex, endDate);
+                stmt.setTimestamp(parameterIndex + endIndex, endDate);
             }
             stmt.execute();
             ResultSet rs = stmt.getResultSet();
@@ -251,37 +291,6 @@
     }
     
     /**
-     * Utility method to help build a SQL query from an array of values.  For each
-     * value in the array an 'OR' clause is constructed.
-     * 
-     * @param addOperator a flag indicating whether to add an 'AND' operator 
-     *                    to the clause
-     * @param column the name of the column to filter against
-     * @param values the values to match in the SQL query
-     * @return a String representation of the SQL query clause
-     */
-    private String generateSqlClause(boolean addOperator, String column, 
-            String[] values)
-    {
-        StringBuffer clause = new StringBuffer();
-        if (addOperator) {
-            clause.append(" and ");
-        }
-        clause.append("(");
-        for (int i = 0; i < values.length; i++) {
-            if (i > 0) {
-                clause.append(" or ");
-            }
-            clause.append(column);
-            clause.append(" like '");
-            clause.append(values[i]);
-            clause.append("'");
-        }
-        clause.append(")");
-        return clause.toString();
-    }
-    
-    /**
      * Format each returned log record as an XML structure.
      * 
      * @param entryId the identifier of the log entry
Index: src/edu/ucsb/nceas/metacat/ContentTypeProvider.java
===================================================================
--- src/edu/ucsb/nceas/metacat/ContentTypeProvider.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/ContentTypeProvider.java	(revision 6595)
@@ -475,15 +475,14 @@
       return docId;
     }
     // get sql command
-    String sql = "SELECT doctype, docid from xml_documents where docid in (";
+    String sql = "SELECT doctype, docid from xml_documents where docid in ( ";
     // the first element
-    sql = sql + "'"+(String)list.elementAt(0) + "'";
-    for (int i=1; i<list.size(); i++)
-    {
-      String docid = (String) list.elementAt(i);
-      sql = sql + ", '" + docid + "'";
-    }//for
-    // add parensis
+    sql = sql + "?";
+    // remaining values
+    for (int i = 1; i < list.size(); i++) {
+      sql = sql + ", ?";
+    }
+    // add parentheses
     sql = sql + ")";
     logMetacat.info("SQL for select doctype: "+ sql);
     ResultSet rs = null;
@@ -497,6 +496,11 @@
                                  ("ContentTypeProvider.setPhycialDocIdForBeta");
       serialNumber=conn.getCheckOutSerialNumber();
       pStmt = conn.prepareStatement(sql);
+      // set the parameter values
+      for (int i = 0; i < list.size(); i++) {
+        String docid = (String) list.elementAt(i);
+        pStmt.setString(i+1, docid);
+      }
       //execute query
       pStmt.execute();
       rs = pStmt.getResultSet();
Index: src/edu/ucsb/nceas/metacat/PermissionController.java
===================================================================
--- src/edu/ucsb/nceas/metacat/PermissionController.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/PermissionController.java	(revision 6595)
@@ -459,8 +459,8 @@
 			// check out DBConnection
 			conn = DBConnectionPool.getDBConnection("PermissionControl.isAccessDoc");
 			serialNumber = conn.getCheckOutSerialNumber();
-			pStmt = conn.prepareStatement("select doctype from xml_documents where "
-					+ "docid like '" + docId + "'");
+			pStmt = conn.prepareStatement("select doctype from xml_documents where docid like ? ");
+			pStmt.setString(1, docId);
 			pStmt.execute();
 			ResultSet rs = pStmt.getResultSet();
 			boolean hasRow = rs.next();
Index: src/edu/ucsb/nceas/metacat/DocumentImpl.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DocumentImpl.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/DocumentImpl.java	(revision 6595)
@@ -46,6 +46,7 @@
 import java.sql.Statement;
 import java.sql.Timestamp;
 import java.util.Calendar;
+import java.util.Date;
 import java.util.Hashtable;
 import java.util.HashMap;
 import java.util.Iterator;
@@ -165,8 +166,8 @@
     protected String docname = null;
     protected String doctype = null;
     private String validateType = null; //base on dtd or schema
-    private String createdate = null;
-    private String updatedate = null;
+    private Date createdate = null;
+    private Date updatedate = null;
     private String system_id = null;
     private String userowner = null;
     private String userupdated = null;
@@ -291,7 +292,7 @@
     public DocumentImpl(DBConnection conn, long rootNodeId, String docName,
             String docType, String docId, String newRevision, String action,
             String user, String pub, String catalogId, int serverCode, 
-            String createDate, String updateDate)
+            Date createDate, Date updateDate)
             throws SQLException, Exception
     {
         this.connection = conn;
@@ -434,7 +435,7 @@
      */
     public static void registerDocumentInReplication(String docname,
             String doctype, String accnum, String user, int serverCode, 
-            String tableName, String createDate, String updateDate)
+            String tableName, Date createDate, Date updateDate)
             throws SQLException, AccessionNumberException, Exception
     {
         DBConnection conn = null;
@@ -492,7 +493,7 @@
     */
    private static void modifyRecordsInGivenTable(String tableName, String action,
                        String docid, String doctype, String docname, String user,
-                       String rev, int serverCode, String createDate, String updateDate,
+                       String rev, int serverCode, Date createDate, Date updateDate,
                        DBConnection dbconn) throws Exception
    {
       
@@ -499,25 +500,17 @@
       PreparedStatement pstmt = null;
       int revision = (new Integer(rev)).intValue();
       String sqlDateString = DatabaseService.getInstance().getDBAdapter().getDateTimeFunction();
-      if (createDate == null)
-      {
-          createDate = sqlDateString;
+      Date today = new Date(Calendar.getInstance().getTimeInMillis());
+      
+      if (createDate == null){
+          createDate = today;
       }
-      else
-      {
-          createDate = DatabaseService.getInstance().getDBAdapter().toDate(createDate, "YYYY-MM-DD HH24:MI:SS");
+      
+      if (updateDate == null) {
+          updateDate = today;
       }
       
-      if (updateDate == null)
-      {
-          updateDate = sqlDateString;
-      }
-      else
-      {
-          updateDate = DatabaseService.getInstance().getDBAdapter().toDate(updateDate, "YYYY-MM-DD HH24:MI:SS");
-      }
-      try
-      {
+      try {
         
         StringBuffer sql = new StringBuffer();
         if (action != null && action.equals("INSERT")) {
@@ -524,37 +517,48 @@
             
             sql.append("insert into ");
             sql.append(tableName);
-            sql.append(" (docid, docname, " +
-                       "doctype, ");
-            sql.append("user_owner, user_updated, server_location, " +
-                       "rev,date_created");
-            sql.append(", date_updated, public_access) values ('");
-            sql.append(docid).append("','");
-            sql.append(docname).append("','");
-            sql.append(doctype).append("','");
-            sql.append(user).append("','");
-            sql.append(user).append("','");
-            sql.append(serverCode).append("',");
-            sql.append(revision).append(",");
-            sql.append(createDate).append(",");
-            sql.append(updateDate).append(",");
+            sql.append(" (docid, docname, doctype, ");
+            sql.append("user_owner, user_updated, server_location, rev, date_created, ");
+            sql.append("date_updated, public_access) values (");
+            sql.append("?, ");
+            sql.append("?, ");
+            sql.append("?, ");
+            sql.append("?, ");
+            sql.append("?, ");
+            sql.append("?, ");
+            sql.append("?, ");
+            sql.append("?, ");
+            sql.append("?, ");
             sql.append("'0')");
+            // set the values
+            pstmt = dbconn.prepareStatement(sql.toString());
+            pstmt.setString(1, docid);
+            pstmt.setString(2, docname);
+            pstmt.setString(3, doctype);
+            pstmt.setString(4, user);
+            pstmt.setString(5, user);
+            pstmt.setInt(6, serverCode);
+            pstmt.setInt(7, revision);
+            pstmt.setTimestamp(8, new Timestamp(createDate.getTime()));
+            pstmt.setTimestamp(9, new Timestamp(updateDate.getTime()));
+
         } else if (action != null && action.equals("UPDATE")) {
             
-            sql.append("update xml_documents set docname ='");
-            sql.append(docname).append("', ");
-            sql.append("user_updated='");
-            sql.append(user).append("', ");
-            sql.append("server_location='");
-            sql.append(serverCode).append("',");
-            sql.append("rev=");
-            sql.append(revision).append(",");
-            sql.append("date_updated=");
-            sql.append(updateDate);
-            sql.append(" where docid='");
-            sql.append(docid).append("'");
+            sql.append("update xml_documents set docname = ?,");
+            sql.append("user_updated = ?, ");
+            sql.append("server_location= ?, ");
+            sql.append("rev = ?, ");
+            sql.append("date_updated = ?");
+            sql.append(" where docid = ? ");
+            // set the values
+            pstmt = dbconn.prepareStatement(sql.toString());
+            pstmt.setString(1, docname);
+            pstmt.setString(2, user);
+            pstmt.setInt(3, serverCode);
+            pstmt.setInt(4, revision);
+            pstmt.setTimestamp(5, new Timestamp(updateDate.getTime()));
+            pstmt.setString(6, docid);
         }
-        pstmt = dbconn.prepareStatement(sql.toString());
         logMetacat.debug("DocumentImpl.modifyRecordsInGivenTable - executing SQL: " + pstmt.toString());
         pstmt.execute();
         pstmt.close();
@@ -599,7 +603,7 @@
     public static void writeDataFileInReplication(InputStream input,
             String filePath, String docname, String doctype, String accnum,
             String user, String docHomeServer, String notificationServer, 
-            String tableName, boolean timedReplication, String createDate, String updateDate)
+            String tableName, boolean timedReplication, Date createDate, Date updateDate)
             throws SQLException, AccessionNumberException, Exception
     {
         int serverCode = -2;
@@ -880,7 +884,7 @@
     /**
      * get the creation date
      */
-    public String getCreateDate()
+    public Date getCreateDate()
     {
         return createdate;
     }
@@ -888,7 +892,7 @@
     /**
      * get the update date
      */
-    public String getUpdateDate()
+    public Date getUpdateDate()
     {
         return updatedate;
     }
@@ -2029,7 +2033,8 @@
                     .getDBConnection("DocumentImpl.isRevisionOnly");
             serialNumber = dbconn.getCheckOutSerialNumber();
             pstmt = dbconn.prepareStatement("select rev from xml_documents "
-                    + "where docid like '" + newid + "'");
+                    + "where docid like ?");
+            pstmt.setString(1, newid);
             logMetacat.debug("DocumentImpl.isRevisionOnly - executing SQL: " + pstmt.toString());
             pstmt.execute();
             ResultSet rs = pstmt.getResultSet();
@@ -2135,10 +2140,12 @@
             sql.append("date_created, date_updated, user_owner, user_updated,");
             sql.append(" server_location, public_access, rev");
             sql.append(" FROM ").append(table);
-            sql.append(" WHERE docid LIKE '").append(docid);
-            sql.append("' and rev = ").append(revision);
+            sql.append(" WHERE docid LIKE ? ");
+            sql.append(" and rev = ? ");
 
             pstmt = dbconn.prepareStatement(sql.toString());
+            pstmt.setString(1, docid);
+            pstmt.setInt(2, revision);
 
             logMetacat.debug("DocumentImpl.getDocumentInfo - executing SQL: " + pstmt.toString());
             pstmt.execute();
@@ -2148,8 +2155,8 @@
                 this.docname = rs.getString(1);
                 this.doctype = rs.getString(2);
                 this.rootnodeid = rs.getLong(3);
-                this.createdate = rs.getString(4);
-                this.updatedate = rs.getString(5);
+                this.createdate = rs.getTimestamp(4);
+                this.updatedate = rs.getTimestamp(5);
                 this.userowner = rs.getString(6);
                 this.userupdated = rs.getString(7);
                 this.serverlocation = rs.getInt(8);
@@ -2335,26 +2342,17 @@
 
     /** creates SQL code and inserts new document into DB connection */
     private void writeDocumentToDB(String action, String user, String pub,
-            String catalogid, int serverCode, String createDate, String updateDate) throws SQLException, Exception
+            String catalogid, int serverCode, Date createDate, Date updateDate) throws SQLException, Exception
     {
         //System.out.println("!!!!!!!!1write document to db  " +docid +"."+rev);
         String sysdate = DatabaseService.getInstance().getDBAdapter().getDateTimeFunction();
-        if (createDate == null)
-        {
-            createDate = sysdate;
+        Date today = Calendar.getInstance().getTime();
+        if (createDate == null) {
+            createDate = today;
         }
-        else
-        {
-            createDate = DatabaseService.getInstance().getDBAdapter().toDate(createDate, "YYYY-MM-DD HH24:MI:SS");
+        if (updateDate == null) {
+            updateDate = today;
         }
-        if (updateDate == null)
-        {
-            updateDate = sysdate;
-        }
-        else
-        {
-            updateDate = DatabaseService.getInstance().getDBAdapter().toDate(updateDate, "YYYY-MM-DD HH24:MI:SS");
-        }
         DocumentImpl thisdoc = null;
 
         try {
@@ -2370,8 +2368,8 @@
                         + "(docid, rootnodeid, docname, doctype, user_owner, "
                         + "user_updated, date_created, date_updated, "
                         + "public_access, server_location, rev, catalog_id) "
-                        + "VALUES (?, ?, ?, ?, ?, ?, " + createDate + ", "
-                        + updateDate + ", ?, ?, ?, ?)";
+                        + "VALUES (?, ?, ?, ?, ?, ?, ?, "
+                        +  "?, ?, ?, ?, ?)";
                 }
                 else
                 {
@@ -2379,8 +2377,8 @@
                         + "(docid, rootnodeid, docname, doctype, user_owner, "
                         + "user_updated, date_created, date_updated, "
                         + "public_access, server_location, rev) "
-                        + "VALUES (?, ?, ?, ?, ?, ?, " + createDate + ", "
-                        + updateDate + ", ?, ?, ?)";
+                        + "VALUES (?, ?, ?, ?, ?, ?, ?, "
+                        + "?, ?, ?, ?)";
                 }
                 /*pstmt = connection
                         .prepareStatement("INSERT INTO xml_documents "
@@ -2404,8 +2402,11 @@
                 pstmt.setString(4, doctype);
                 pstmt.setString(5, user);
                 pstmt.setString(6, user);
+                // dates
+                pstmt.setTimestamp(7, new Timestamp(createDate.getTime()));
+                pstmt.setTimestamp(8, new Timestamp(updateDate.getTime()));
                 //public access is usefulless, so set it to null
-                pstmt.setInt(7, 0);
+                pstmt.setInt(9, 0);
                 /*
                  * if ( pub == null ) { pstmt.setString(7, null); } else if (
                  * pub.toUpperCase().equals("YES") || pub.equals("1") ) {
@@ -2413,12 +2414,12 @@
                  * pub.toUpperCase().equals("NO") || pub.equals("0") ) {
                  * pstmt.setInt(7, 0); }
                  */
-                pstmt.setInt(8, serverCode);
-                pstmt.setInt(9, rev);
+                pstmt.setInt(10, serverCode);
+                pstmt.setInt(11, rev);
                
                 if (catalogid != null)
                 {
-                  pstmt.setInt(10, (new Integer(catalogid)).intValue());
+                  pstmt.setInt(12, (new Integer(catalogid)).intValue());
                 }
                 
                 
@@ -2466,9 +2467,7 @@
                 {
                 	updateSql = "UPDATE xml_documents "
                         + "SET rootnodeid = ?, docname = ?, doctype = ?, "
-                        + "user_updated = ?, date_updated = "
-                        + updateDate
-                        + ", "
+                        + "user_updated = ?, date_updated = ?, "
                         + "server_location = ?, rev = ?, public_access = ?, "
                         + "catalog_id = ? "
                         + "WHERE docid = ?";
@@ -2477,21 +2476,10 @@
                 {
                 	updateSql = "UPDATE xml_documents "
                         + "SET rootnodeid = ?, docname = ?, doctype = ?, "
-                        + "user_updated = ?, date_updated = "
-                        + updateDate
-                        + ", "
+                        + "user_updated = ?, date_updated = ?, "
                         + "server_location = ?, rev = ?, public_access = ? "
                         + "WHERE docid = ?";
                 }
-                /*pstmt = connection
-                        .prepareStatement("UPDATE xml_documents "
-                        + "SET rootnodeid = ?, docname = ?, doctype = ?, "
-                        + "user_updated = ?, date_updated = "
-                        + updateDate
-                        + ", "
-                        + "server_location = ?, rev = ?, public_access = ?, "
-                        + "catalog_id = ? "
-                        + "WHERE docid = ?");*/
                 // Increase dbconnection usage count
                 pstmt = connection.prepareStatement(updateSql);
                 connection.increaseUsageCount(1);
@@ -2500,9 +2488,10 @@
                 pstmt.setString(2, docname);
                 pstmt.setString(3, doctype);
                 pstmt.setString(4, user);
-                pstmt.setInt(5, serverCode);
-                pstmt.setInt(6, thisrev);
-                pstmt.setInt(7, 0);
+                pstmt.setTimestamp(5, new Timestamp(updateDate.getTime()));
+                pstmt.setInt(6, serverCode);
+                pstmt.setInt(7, thisrev);
+                pstmt.setInt(8, 0);
                 /*
                  * if ( pub == null ) { pstmt.setString(7, null); } else if (
                  * pub.toUpperCase().equals("YES") || pub.equals("1") ) { pstmt
@@ -2511,12 +2500,12 @@
                  */
                 if (catalogid != null)
                 {
-                  pstmt.setInt(8, (new Integer(catalogid)).intValue());
-                  pstmt.setString(9, this.docid);
+                  pstmt.setInt(9, (new Integer(catalogid)).intValue());
+                  pstmt.setString(10, this.docid);
                 }
                 else
                 {
-                  pstmt.setString(8, this.docid);
+                  pstmt.setString(9, this.docid);
                 }
 
             } else {
@@ -2907,7 +2896,7 @@
             String pub, Reader dtd, String action, String accnum, String user,
             String[] groups, String homeServer, String notifyServer,
             String ruleBase, boolean needValidation, String tableName, 
-            boolean timedReplication, String createDate, String updateDate) throws Exception
+            boolean timedReplication, Date createDate, Date updateDate) throws Exception
     {
     	// Get the xml as a string so we can write to file later
     	StringReader xmlReader = new StringReader(xmlString);
@@ -3495,7 +3484,7 @@
             String action, String docid, Reader xml, String rev, String user,
             String[] groups, String pub, int serverCode, Reader dtd,
             String ruleBase, boolean needValidation, boolean isRevision,
-            String createDate, String updateDate, String encoding) throws Exception
+            Date createDate, Date updateDate, String encoding) throws Exception
     {
         XMLReader parser = null;
         try {
@@ -3880,7 +3869,8 @@
             serialNumber = conn.getCheckOutSerialNumber();
             //delete a record
             pStmt = conn.prepareStatement(
-                    "DELETE FROM xml_documents WHERE docid = '" + docId + "'");
+                    "DELETE FROM xml_documents WHERE docid = ? ");
+            pStmt.setString(1, docId);
             logMetacat.debug("DocumentImpl.deleteXMLDocuments - executing SQL: " + pStmt.toString());
             pStmt.execute();
         } finally {
@@ -3921,8 +3911,8 @@
             serialNumber = conn.getCheckOutSerialNumber();
 
             pStmt = conn
-                    .prepareStatement("SELECT server_location FROM xml_documents WHERE docid='"
-                            + docId + "'");
+                    .prepareStatement("SELECT server_location FROM xml_documents WHERE docid = ?");
+            pStmt.setString(1, docId);
             pStmt.execute();
 
             ResultSet rs = pStmt.getResultSet();
@@ -3982,8 +3972,8 @@
                     .getDBConnection("DocumentImpl.getServerCode");
             serialNumber = dbConn.getCheckOutSerialNumber();
             pStmt = dbConn
-                    .prepareStatement("SELECT serverid FROM xml_replication WHERE server='"
-                            + serverName + "'");
+                    .prepareStatement("SELECT serverid FROM xml_replication WHERE server = ?");
+            pStmt.setString(1, serverName);
             pStmt.execute();
 
             ResultSet rs = pStmt.getResultSet();
@@ -4040,8 +4030,8 @@
 
             // Compare the server to dabase
             pStmt = dbConn
-                    .prepareStatement("SELECT serverid FROM xml_replication WHERE server='"
-                            + server + "'");
+                    .prepareStatement("SELECT serverid FROM xml_replication WHERE server = ?");
+            pStmt.setString(1, server);
             pStmt.execute();
             ResultSet rs = pStmt.getResultSet();
             boolean hasRow = rs.next();
@@ -4063,13 +4053,18 @@
                  * 'MM/DD/YY'), '" + replicate +"', '"+dataReplicate+"','"+ hub +
                  * "')");
                  */
+                
+                Calendar cal = Calendar.getInstance();
+                cal.set(1980, 1, 1);
                 pStmt = dbConn
                         .prepareStatement("INSERT INTO xml_replication "
                                 + "(server, last_checked, replicate, datareplicate, hub) "
-                                + "VALUES ('" + server + "', "
-                                + DatabaseService.getInstance().getDBAdapter().toDate("01/01/1980", "MM/DD/YYYY")
-                                + ", '" + replicate + "', '" + dataReplicate
-                                + "','" + hub + "')");
+                                + "VALUES (?, ?, ?, ?, ?)");
+                pStmt.setString(1, server);
+				pStmt.setTimestamp(2, new Timestamp(cal.getTimeInMillis()) );
+                pStmt.setInt(3, replicate);
+                pStmt.setInt(4, dataReplicate);
+                pStmt.setInt(5, hub);
 
                 logMetacat.debug("DocumentImpl.insertServerIntoReplicationTable - executing SQL: " + pStmt.toString());
                 pStmt.execute();
@@ -4255,29 +4250,20 @@
      */
     private static void writeDocumentToRevisionTable(DBConnection con, String docId, 
             String rev, String docType, String docName, String user, 
-            String catalogid, int serverCode, long rootNodeId, String createDate, String updateDate) throws SQLException, Exception
+            String catalogid, int serverCode, long rootNodeId, Date createDate, Date updateDate) throws SQLException, Exception
     {
         
         try 
         {
+            Date today = Calendar.getInstance().getTime();
+            if (createDate == null){
+                createDate = today;
+            }
             
-            if (createDate == null)
-            {
-                createDate = DatabaseService.getInstance().getDBAdapter().getDateTimeFunction();
-            }
-            else
-            {
-                createDate = DatabaseService.getInstance().getDBAdapter().toDate(createDate, "YYYY-MM-DD HH24:MI:SS");
-            }
             logMetacat.debug("DocumentImpl.writeDocumentToRevisionTable - the create date is "+createDate);
-            if (updateDate == null)
-            {
-                updateDate = DatabaseService.getInstance().getDBAdapter().getDateTimeFunction();
+            if (updateDate == null){
+                updateDate = today;
             }
-            else
-            {
-                updateDate = DatabaseService.getInstance().getDBAdapter().toDate(updateDate, "YYYY-MM-DD HH24:MI:SS");
-            }
             logMetacat.debug("DocumentImpl.writeDocumentToRevisionTable - the update date is "+updateDate);
             PreparedStatement pstmt = null;
             String sql = null;
@@ -4289,8 +4275,8 @@
                    + "(docid, docname, doctype, user_owner, "
                    + "user_updated, date_created, date_updated, "
                    + "public_access, server_location, rev) "
-                   + "VALUES (?, ?, ?, ?, ?, " + createDate + ", "
-                   + updateDate + ", ?, ?, ?)";
+                   + "VALUES (?, ?, ?, ?, ?, ?,"
+                   + " ?, ?, ?, ?)";
             }
             else
             {
@@ -4300,8 +4286,8 @@
                     + "(docid, docname, doctype, user_owner, "
                     + "user_updated, date_created, date_updated, "
                     + "public_access, server_location, rev, catalog_id, rootnodeid ) "
-                    + "VALUES (?, ?, ?, ?, ?, " + createDate + ", "
-                    + updateDate + ", ?, ?, ?, ?, ?)";
+                    + "VALUES (?, ?, ?, ?, ?, ?, "
+                    + "?, ?, ?, ?, ?)";
                 }
                 else
                 {
@@ -4309,8 +4295,8 @@
                         + "(docid, docname, doctype, user_owner, "
                         + "user_updated, date_created, date_updated, "
                         + "public_access, server_location, rev, rootnodeid ) "
-                        + "VALUES (?, ?, ?, ?, ?, " + createDate + ", "
-                        + updateDate + ", ?, ?, ?, ?)";
+                        + "VALUES (?, ?, ?, ?, ?, ?, "
+                        + "?, ?, ?, ?, ?)";
                 }
             }
             pstmt = con.prepareStatement(sql);
@@ -4328,25 +4314,28 @@
             logMetacat.debug("DocumentImpl.writeDocumentToRevisionTable - onwer is "+user);
             pstmt.setString(5, user);
             logMetacat.debug("DocumentImpl.writeDocumentToRevisionTable - update user is "+user);
-            pstmt.setInt(6, 0);
+            pstmt.setTimestamp(6, new Timestamp(createDate.getTime()));
+            pstmt.setTimestamp(7, new Timestamp(updateDate.getTime()));
             
-            pstmt.setInt(7, serverCode);
+            pstmt.setInt(8, 0);
+            
+            pstmt.setInt(9, serverCode);
             logMetacat.debug("DocumentImpl.writeDocumentToRevisionTable - server code is "+serverCode);
-            pstmt.setInt(8, Integer.parseInt(rev));
+            pstmt.setInt(10, Integer.parseInt(rev));
             logMetacat.debug("DocumentImpl.writeDocumentToRevisionTable - rev is "+rev);
             
-            if (rootNodeId >0 )
+            if (rootNodeId > 0 )
             {
               if (catalogid != null)
               {
-                pstmt.setInt(9, (new Integer(catalogid)).intValue());
+                pstmt.setInt(11, (new Integer(catalogid)).intValue());
                 logMetacat.debug("DocumentImpl.writeDocumentToRevisionTable - catalog id is "+catalogid);
-                pstmt.setLong(10, rootNodeId);
+                pstmt.setLong(12, rootNodeId);
                 logMetacat.debug("DocumentImpl.writeDocumentToRevisionTable - root id is "+rootNodeId);
               }
               else
               {
-                 pstmt.setLong(9, rootNodeId);
+                 pstmt.setLong(11, rootNodeId);
                  logMetacat.debug("DocumentImpl.writeDocumentToRevisionTable - root id is "+rootNodeId); 
               }
             }
@@ -4379,7 +4368,7 @@
      */
     static private void registerDeletedDataFile(String docname,
             String doctype, String accnum, String user, int serverCode, 
-            String createDate, String updateDate) throws Exception
+            Date createDate, Date updateDate) throws Exception
     {
         DBConnection dbconn = null;
         int serialNumber = -1;
@@ -4421,8 +4410,9 @@
     	logMetacat.debug("DocumentImpl.deleteXMLNodes - for root Id: " + rootId);
         PreparedStatement pstmt = null;
         double start = System.currentTimeMillis()/1000;
-        String sql = "DELETE FROM xml_nodes WHERE rootnodeid ="+ rootId;
+        String sql = "DELETE FROM xml_nodes WHERE rootnodeid = ? ";
         pstmt = dbconn.prepareStatement(sql);
+        pstmt.setLong(1, rootId);
         // Increase dbconnection usage count
         dbconn.increaseUsageCount(1);
         logMetacat.debug("DocumentImpl.deleteXMLNodes - executing SQL: " + pstmt.toString());
Index: src/edu/ucsb/nceas/metacat/DocumentImplWrapper.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DocumentImplWrapper.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/DocumentImplWrapper.java	(revision 6595)
@@ -28,6 +28,7 @@
 package edu.ucsb.nceas.metacat;
 
 import java.io.Reader;
+import java.util.Date;
 
 import edu.ucsb.nceas.metacat.database.DBConnection;
 
@@ -63,7 +64,7 @@
 
 	public String writeReplication(DBConnection conn, String xml, String pub, Reader dtd,
 			String action, String accnum, String user, String[] groups,
-			String homeServer, String notifyServer, String createDate, String updateDate)
+			String homeServer, String notifyServer, Date createDate, Date updateDate)
 			throws Exception {
 		//we don't need to check validation in replication
 		// so rule base is null and need validation is false (first false)
@@ -96,7 +97,7 @@
 	public String writeReplication(DBConnection conn, String xml, String pub, Reader dtd,
 			String action, String accnum, String user, String[] groups,
 			String homeServer, String notifyServer, String tableName,
-			boolean timedReplication, String createDate, String updateDate)
+			boolean timedReplication, Date createDate, Date updateDate)
 			throws Exception {
 		//we don't need to check validation in replication
 		// so rule base is null and need validation is false
Index: src/edu/ucsb/nceas/metacat/RelationHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/RelationHandler.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/RelationHandler.java	(revision 6595)
@@ -163,7 +163,8 @@
     try {
       PreparedStatement pstmt = connection.prepareStatement(
                                 "DELETE FROM xml_relation " +
-                                "WHERE docid = '" + docid + "'");
+                                "WHERE docid = ?");
+      pstmt.setString(1, docid);
       //increase usage count
       connection.increaseUsageCount(1);
       pstmt.execute();
@@ -191,8 +192,8 @@
 		StringBuffer sql = new StringBuffer();
 		sql
 				.append("SELECT docid, rev FROM xml_documents WHERE docid in (SELECT subject ");
-		sql.append("FROM xml_relation WHERE docid='").append(docid);
-		sql.append("' AND (");
+		sql.append("FROM xml_relation WHERE docid = ? ");
+		sql.append(" AND (");
 		Vector accessdoctypes;
 		try {
 			accessdoctypes = MetacatUtil.getOptionList(PropertyService
@@ -214,6 +215,7 @@
 			dbConn = DBConnectionPool.getDBConnection("RelationHandler.getAccessFileID");
 			serialNumber = dbConn.getCheckOutSerialNumber();
 			pstmt = dbConn.prepareStatement(sql.toString());
+			pstmt.setString(1, docid);
 			pstmt.execute();
 			ResultSet rs = pstmt.getResultSet();
 			boolean hasRow = rs.next();
Index: src/edu/ucsb/nceas/metacat/AccessionNumber.java
===================================================================
--- src/edu/ucsb/nceas/metacat/AccessionNumber.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/AccessionNumber.java	(revision 6595)
@@ -265,7 +265,8 @@
       conn=DBConnectionPool.getDBConnection("AccessionNumber.getLastRevision");
       serialNumber=conn.getCheckOutSerialNumber();
       pstmt = conn.prepareStatement
-              ("SELECT rev FROM xml_documents WHERE docid='" + docid + "'");
+              ("SELECT rev FROM xml_documents WHERE docid = ?");
+      pstmt.setString(1, docid);
       pstmt.execute();
 
       ResultSet rs = pstmt.getResultSet();
@@ -303,7 +304,8 @@
       serialNumber=conn.getCheckOutSerialNumber();
 
       pStmt = conn.prepareStatement
-              ("SELECT rev FROM xml_documents WHERE docid='" + docId + "'");
+              ("SELECT rev FROM xml_documents WHERE docid = ? ");
+      pStmt.setString(1, docId);
       pStmt.execute();
 
       ResultSet rs = pStmt.getResultSet();
Index: src/edu/ucsb/nceas/metacat/DBUtil.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DBUtil.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/DBUtil.java	(revision 6595)
@@ -867,8 +867,8 @@
           serialNumber = dbConn.getCheckOutSerialNumber();
 
           pStmt = dbConn
-                  .prepareStatement("SELECT rev FROM xml_revisions WHERE docid='"
-                          + docIdWithoutRev + "'");
+                  .prepareStatement("SELECT rev FROM xml_revisions WHERE docid = ?");
+          pStmt.setString(1, docIdWithoutRev);
           pStmt.execute();
 
           ResultSet rs = pStmt.getResultSet();
@@ -918,8 +918,8 @@
           serialNumber = dbConn.getCheckOutSerialNumber();
 
           pStmt = dbConn
-                  .prepareStatement("SELECT rev FROM xml_documents WHERE docid='"
-                          + docIdWithoutRev + "'");
+                  .prepareStatement("SELECT rev FROM xml_documents WHERE docid = ?");
+          pStmt.setString(1, docIdWithoutRev);
           pStmt.execute();
 
           ResultSet rs = pStmt.getResultSet();
Index: src/edu/ucsb/nceas/metacat/DBSAXHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DBSAXHandler.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/DBSAXHandler.java	(revision 6595)
@@ -29,6 +29,7 @@
 
 import java.sql.ResultSet;
 import java.sql.Statement;
+import java.util.Date;
 import java.util.EmptyStackException;
 import java.util.Enumeration;
 import java.util.Hashtable;
@@ -83,9 +84,9 @@
 
     protected DocumentImpl currentDocument;
     
-    protected String createDate = null;
+    protected Date createDate = null;
     
-    protected String updateDate = null;
+    protected Date updateDate = null;
 
     protected DBSAXNode rootNode;
 
@@ -149,7 +150,7 @@
      *
      * @param conn the JDBC connection to which information is written
      */
-    private DBSAXHandler(DBConnection conn, String createDate, String updateDate)
+    private DBSAXHandler(DBConnection conn, Date createDate, Date updateDate)
     {
         this.connection = conn;
         this.atFirstElement = true;
@@ -210,7 +211,7 @@
      */
     public DBSAXHandler(DBConnection conn, String action, String docid,
             String revision, String user, String[] groups, String pub,
-            int serverCode, String createDate, String updateDate)
+            int serverCode, Date createDate, Date updateDate)
     {
         this(conn, createDate, updateDate);
         this.action = action;
Index: src/edu/ucsb/nceas/metacat/Sitemap.java
===================================================================
--- src/edu/ucsb/nceas/metacat/Sitemap.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/Sitemap.java	(revision 6595)
@@ -122,8 +122,7 @@
                 serialNumber = dbConn.getCheckOutSerialNumber();
 
                 // Execute the query statement
-                PreparedStatement stmt = dbConn.prepareStatement(query
-                        .toString());
+                PreparedStatement stmt = dbConn.prepareStatement(query.toString());
                 stmt.execute();
                 ResultSet rs = stmt.getResultSet();
 
Index: src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java	(revision 6595)
@@ -42,6 +42,7 @@
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Statement;
+import java.util.Date;
 import java.util.EmptyStackException;
 import java.util.Enumeration;
 import java.util.Hashtable;
@@ -330,7 +331,7 @@
      */
     public Eml200SAXHandler(DBConnection conn, String action, String docid,
             String revision, String user, String[] groups, String pub,
-            int serverCode, String createDate, String updateDate) throws SAXException
+            int serverCode, Date createDate, Date updateDate) throws SAXException
     {
         super(conn, action, docid, revision, user, groups, pub, 
                 serverCode, createDate, updateDate);
Index: src/edu/ucsb/nceas/metacat/Eml210SAXHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/Eml210SAXHandler.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/Eml210SAXHandler.java	(revision 6595)
@@ -36,6 +36,7 @@
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Statement;
+import java.util.Date;
 import java.util.EmptyStackException;
 import java.util.Enumeration;
 import java.util.Hashtable;
@@ -190,7 +191,7 @@
 	 */
 	public Eml210SAXHandler(DBConnection conn, String action, String docid,
 			String revision, String user, String[] groups, String pub, int serverCode,
-			String createDate, String updateDate) throws SAXException {
+			Date createDate, Date updateDate) throws SAXException {
 		super(conn, action, docid, revision, user, groups, pub, serverCode, createDate,
 				updateDate);
 		// Get the unchangeable subtrees (user doesn't have write permission)
Index: src/edu/ucsb/nceas/metacat/IdentifierManager.java
===================================================================
--- src/edu/ucsb/nceas/metacat/IdentifierManager.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/IdentifierManager.java	(revision 6595)
@@ -486,7 +486,7 @@
         Hashtable<String, Object> h = new Hashtable<String, Object>();
         String sql = "select docname, doctype, user_owner, user_updated, " +
             "server_location, rev, date_created, date_updated from " + 
-            "xml_documents where docid like '" + localId + "'";
+            "xml_documents where docid like ?";
         DBConnection dbConn = null;
         int serialNumber = -1;
         try 
@@ -497,6 +497,7 @@
 
             // Execute the insert statement
             PreparedStatement stmt = dbConn.prepareStatement(sql);
+            stmt.setString(1, localId);
             ResultSet rs = stmt.executeQuery();
             if (rs.next()) 
             {
@@ -581,7 +582,7 @@
             //do nothing. just try the localId as it is
         }
         int rev = 0;
-        String sql = "select rev from xml_documents where docid like '" + localId + "'";
+        String sql = "select rev from xml_documents where docid like ? ";
         DBConnection dbConn = null;
         int serialNumber = -1;
         try 
@@ -592,6 +593,7 @@
 
             // Execute the insert statement
             PreparedStatement stmt = dbConn.prepareStatement(sql);
+            stmt.setString(1, localId);
             ResultSet rs = stmt.executeQuery();
             if (rs.next()) 
             {
@@ -1042,10 +1044,11 @@
             serialNumber = dbConn.getCheckOutSerialNumber();
 
             // Execute the update statement
-            String query = "update " + TYPE_IDENTIFIER + " set (docid, rev) = (?, ?) where guid='" + guid + "'";
+            String query = "update " + TYPE_IDENTIFIER + " set (docid, rev) = (?, ?) where guid = ?";
             PreparedStatement stmt = dbConn.prepareStatement(query);
             stmt.setString(1, docid);
             stmt.setInt(2, rev);
+            stmt.setString(3, guid);
             int rows = stmt.executeUpdate();
 
             stmt.close();
Index: src/edu/ucsb/nceas/metacat/DocumentIdentifier.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DocumentIdentifier.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/DocumentIdentifier.java	(revision 6595)
@@ -154,8 +154,8 @@
       dbConn=DBConnectionPool.
                   getDBConnection("DocumentIdentifier.getNewestRev");
       serialNumber=dbConn.getCheckOutSerialNumber();
-      pstmt = dbConn.prepareStatement("select rev from xml_documents where " +
-                                    "docid like '" + docid + "'");
+      pstmt = dbConn.prepareStatement("select rev from xml_documents where docid like ? ");
+      pstmt.setString(1, docid);
       pstmt.execute();
       ResultSet rs = pstmt.getResultSet();
       boolean tablehasrows = rs.next();
Index: src/edu/ucsb/nceas/metacat/replication/ReplicationHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/replication/ReplicationHandler.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/replication/ReplicationHandler.java	(revision 6595)
@@ -35,13 +35,17 @@
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
+import java.sql.Timestamp;
 import java.text.DateFormat;
 import java.text.ParseException;
+import java.util.Calendar;
 import java.util.Date;
 import java.util.Hashtable;
 import java.util.TimerTask;
 import java.util.Vector;
 
+import javax.xml.bind.DatatypeConverter;
+
 import org.apache.log4j.Logger;
 import org.dataone.service.types.v1.SystemMetadata;
 import org.dataone.service.util.TypeMarshaller;
@@ -391,8 +395,13 @@
       // Get home server of the docid
       String docHomeServer = docinfoHash.get("home_server");
       logReplication.info("ReplicationHandler.handleSingleXMLDocument - doc home server in repl: "+docHomeServer);
-      String createdDate = docinfoHash.get("date_created");
-      String updatedDate = docinfoHash.get("date_updated");
+     
+      // dates
+      String createdDateString = docinfoHash.get("date_created");
+      String updatedDateString = docinfoHash.get("date_updated");
+      Date createdDate = DatatypeConverter.parseDateTime(createdDateString).getTime();
+      Date updatedDate = DatatypeConverter.parseDateTime(updatedDateString).getTime();
+      
       //docid should include rev number too
       /*String accnum=docId+util.getProperty("document.accNumSeparator")+
                                               (String)docinfoHash.get("rev");*/
@@ -553,8 +562,10 @@
       // Get docid home sever. it might be different to remoteserver
       // because of hub feature
       String docHomeServer = docinfoHash.get("home_server");
-      String createdDate = docinfoHash.get("date_created");
-      String updatedDate = docinfoHash.get("date_updated");
+      String createdDateString = docinfoHash.get("date_created");
+      String updatedDateString = docinfoHash.get("date_updated");
+      Date createdDate = DatatypeConverter.parseDateTime(createdDateString).getTime();
+      Date updatedDate = DatatypeConverter.parseDateTime(updatedDateString).getTime();
       //docid should include rev number too
       /*String accnum=docId+util.getProperty("document.accNumSeparator")+
                                               (String)docinfoHash.get("rev");*/
@@ -762,18 +773,19 @@
       MetacatUtil.getLocalReplicationServerName()+"&action=gettime");
       String datexml = ReplicationService.getURLContent(dateurl);
       logReplication.info("ReplicationHandler.updateLastCheckTimeForSingleServer - datexml: "+datexml);
-      if (datexml!=null && !datexml.equals(""))
-      {
+      if (datexml != null && !datexml.equals("")) {
+    	  
+    	  // parse the ISO datetime
          String datestr = datexml.substring(11, datexml.indexOf('<', 11));
+         Calendar updated = DatatypeConverter.parseDateTime(datestr);
+         
          StringBuffer sql = new StringBuffer();
-         /*sql.append("update xml_replication set last_checked = to_date('");
-         sql.append(datestr).append("', 'YY-MM-DD HH24:MI:SS') where ");
-         sql.append("server like '").append(server).append("'");*/
-         sql.append("update xml_replication set last_checked = ");
-         sql.append(DatabaseService.getInstance().getDBAdapter().toDate(datestr, "MM/DD/YY HH24:MI:SS"));
-         sql.append(" where server like '").append(server).append("'");
+         sql.append("update xml_replication set last_checked = ? ");
+         sql.append(" where server like ? ");
          pstmt = dbConn.prepareStatement(sql.toString());
-
+         pstmt.setTimestamp(1, new Timestamp(updated.getTimeInMillis()));
+         pstmt.setString(2, server);
+         
          pstmt.executeUpdate();
          dbConn.commit();
          pstmt.close();
@@ -1013,9 +1025,9 @@
       boolean xml_revs = false;
 
       StringBuffer sb = new StringBuffer();
-      sb.append("select docid from xml_revisions where docid like '");
-      sb.append(docid).append("'");
+      sb.append("select docid from xml_revisions where docid like ? ");
       pstmt = dbConn.prepareStatement(sb.toString());
+      pstmt.setString(1, docid);
       pstmt.execute();
       ResultSet rs = pstmt.getResultSet();
       boolean tablehasrows = rs.next();
Index: src/edu/ucsb/nceas/metacat/replication/ReplicationService.java
===================================================================
--- src/edu/ucsb/nceas/metacat/replication/ReplicationService.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/replication/ReplicationService.java	(revision 6595)
@@ -47,7 +47,9 @@
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
+import java.sql.Timestamp;
 import java.text.SimpleDateFormat;
+import java.util.Calendar;
 import java.util.Date;
 import java.util.Hashtable;
 import java.util.List;
@@ -56,6 +58,7 @@
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import javax.xml.bind.DatatypeConverter;
 
 import org.apache.http.HttpResponse;
 import org.apache.http.conn.scheme.Scheme;
@@ -323,18 +326,20 @@
 				//Get hub value
 				hub = ((String[]) params.get("hub"))[0];
 
-				String toDateSql = DatabaseService.getInstance().getDBAdapter().toDate("01/01/1980","MM/DD/YYYY");
+				Calendar cal = Calendar.getInstance();
+                cal.set(1980, 1, 1);
 				String sql = "INSERT INTO xml_replication "
 						+ "(server, last_checked, replicate, datareplicate, systemmetadatareplicate, hub) "
-						+ "VALUES (?," + toDateSql + ",?,?,?,?)";
+						+ "VALUES (?,?,?,?,?,?)";
 				
 				pstmt = dbConn.prepareStatement(sql);
 						
 				pstmt.setString(1, server);
-				pstmt.setInt(2, Integer.parseInt(replicate));
-				pstmt.setInt(3, Integer.parseInt(dataReplicate));
-				pstmt.setInt(4, Integer.parseInt(systemMetadataReplicate));
-				pstmt.setInt(5, Integer.parseInt(hub));
+				pstmt.setTimestamp(2, new Timestamp(cal.getTimeInMillis()));
+				pstmt.setInt(3, Integer.parseInt(replicate));
+				pstmt.setInt(4, Integer.parseInt(dataReplicate));
+				pstmt.setInt(5, Integer.parseInt(systemMetadataReplicate));
+				pstmt.setInt(6, Integer.parseInt(hub));
 				
 				String sqlReport = "XMLAccessAccess.getXMLAccessForDoc - SQL: " + sql;
 				sqlReport += " [" + server + "," + replicate + 
@@ -384,7 +389,8 @@
 			} else if (subaction.equals("delete")) {
 				server = ((String[]) params.get("server"))[0];
 				pstmt = dbConn.prepareStatement("DELETE FROM xml_replication "
-						+ "WHERE server LIKE '" + server + "'");
+						+ "WHERE server LIKE ?");
+				pstmt.setString(1, server);
 				pstmt.execute();
 				pstmt.close();
 				dbConn.commit();
@@ -601,9 +607,12 @@
 				IdentifierManager.getInstance().createMapping(sysMeta.getIdentifier().getValue(), docid);
 			}
       
-        	// replicate doc contents
-			String createdDate = (String) docinfoHash.get("date_created");
-			String updatedDate = (String) docinfoHash.get("date_updated");
+			// dates
+			String createdDateString = docinfoHash.get("date_created");
+			String updatedDateString = docinfoHash.get("date_updated");
+			Date createdDate = DatatypeConverter.parseDateTime(createdDateString).getTime();
+			Date updatedDate = DatatypeConverter.parseDateTime(updatedDateString).getTime();
+		      
 			logReplication.info("ReplicationService.handleForceReplicateRequest - homeServer: " + homeServer);
 			// Get Document type
 			String docType = (String) docinfoHash.get("doctype");
@@ -811,10 +820,13 @@
 			String docType = (String) docinfoHash.get("doctype");
 
 			String docHomeServer = (String) docinfoHash.get("home_server");
-
-			String createdDate = (String) docinfoHash.get("date_created");
-
-			String updatedDate = (String) docinfoHash.get("date_updated");
+			
+			String createdDateString = docinfoHash.get("date_created");
+			String updatedDateString = docinfoHash.get("date_updated");
+			
+			Date createdDate = DatatypeConverter.parseDateTime(createdDateString).getTime();
+			Date updatedDate = DatatypeConverter.parseDateTime(updatedDateString).getTime();
+			
 			logReplication.info("ReplicationService.handleForceReplicateDataFileRequest - docHomeServer of datafile: " + docHomeServer);
 
 			if (dbaction.equals("insert") || dbaction.equals("update")) {
@@ -972,6 +984,12 @@
 			} catch(McdbDocNotFoundException e) {
 			  logMetacat.warn("No SystemMetadata found for: " + docid);
 			}
+			
+			Calendar created = Calendar.getInstance();
+			created.setTime(doc.getCreateDate());
+			Calendar updated = Calendar.getInstance();
+			updated.setTime(doc.getUpdateDate());
+			
 			sb.append("<docname>").append(doc.getDocname());
 			sb.append("</docname><doctype>").append(doc.getDoctype());
 			sb.append("</doctype>");
@@ -979,10 +997,10 @@
 			sb.append("</user_owner><user_updated>").append(doc.getUserupdated());
 			sb.append("</user_updated>");
 			sb.append("<date_created>");
-			sb.append(doc.getCreateDate());
+			sb.append(DatatypeConverter.printDateTime(created));
 			sb.append("</date_created>");
 			sb.append("<date_updated>");
-			sb.append(doc.getUpdateDate());
+			sb.append(DatatypeConverter.printDateTime(updated));
 			sb.append("</date_updated>");
 			sb.append("<home_server>");
 			sb.append(doc.getDocHomeServer());
@@ -1739,10 +1757,10 @@
 	 */
 	protected static void handleGetTimeRequest(
 			Hashtable<String, String[]> params, HttpServletResponse response) {
-		SimpleDateFormat formatter = new SimpleDateFormat("MM/dd/yy HH:mm:ss");
-		java.util.Date localtime = new java.util.Date();
-		String dateString = formatter.format(localtime);
 		
+		// use standard ISO format -- the receiving end wants this too
+		String dateString = DatatypeConverter.printDateTime(Calendar.getInstance());
+		
 		// get a writer for sending back to response
 		response.setContentType("text/xml");
 		Writer out = null;
@@ -1795,8 +1813,9 @@
 			dbConn = DBConnectionPool.getDBConnection("MetacatReplication.getServer");
 			serialNumber = dbConn.getCheckOutSerialNumber();
 			String sql = new String("select server from "
-					+ "xml_replication where serverid = " + serverCode);
+					+ "xml_replication where serverid = ?");
 			pstmt = dbConn.prepareStatement(sql);
+			pstmt.setInt(1, serverCode);
 			//System.out.println("getserver sql: " + sql);
 			pstmt.execute();
 			ResultSet rs = pstmt.getResultSet();
@@ -1846,7 +1865,8 @@
 			dbConn = DBConnectionPool.getDBConnection("MetacatReplication.getServerCode");
 			serialNumber = dbConn.getCheckOutSerialNumber();
 			pstmt = dbConn.prepareStatement("SELECT serverid FROM xml_replication "
-					+ "WHERE server LIKE '" + server + "'");
+					+ "WHERE server LIKE ?");
+			pstmt.setString(1, server);
 			pstmt.execute();
 			ResultSet rs = pstmt.getResultSet();
 			boolean tablehasrows = rs.next();
@@ -1971,7 +1991,8 @@
 					.getDBConnection("ReplicationHandler.getServerLocation");
 			serialNumber = dbConn.getCheckOutSerialNumber();
 			pstmt = dbConn.prepareStatement("SELECT server_location FROM xml_documents "
-					+ "WHERE docid LIKE '" + docId + "'");
+					+ "WHERE docid LIKE ? ");
+			pstmt.setString(1, docId);
 			pstmt.execute();
 			ResultSet rs = pstmt.getResultSet();
 			boolean tablehasrows = rs.next();
@@ -2142,7 +2163,8 @@
 			dbConn = DBConnectionPool.getDBConnection("MetacatReplication.repltoServer");
 			serialNumber = dbConn.getCheckOutSerialNumber();
 			pstmt = dbConn.prepareStatement("select replicate from "
-					+ "xml_replication where server like '" + server + "'");
+					+ "xml_replication where server like ? ");
+			pstmt.setString(1, server);
 			pstmt.execute();
 			ResultSet rs = pstmt.getResultSet();
 			boolean tablehasrows = rs.next();
Index: src/edu/ucsb/nceas/metacat/replication/ReplicationServerList.java
===================================================================
--- src/edu/ucsb/nceas/metacat/replication/ReplicationServerList.java	(revision 6594)
+++ src/edu/ucsb/nceas/metacat/replication/ReplicationServerList.java	(revision 6595)
@@ -30,6 +30,8 @@
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
+import java.sql.Timestamp;
+import java.util.Calendar;
 import java.util.Date;
 import java.util.Vector;
 
@@ -478,6 +480,8 @@
       // Add this server to xml_table too
      try
       {
+    	 Calendar cal = Calendar.getInstance();
+         cal.set(1980, 1, 1);
         // Checkout DBConnection     
         dbConn=DBConnectionPool.
              getDBConnection("ReplicationSErverList.addToServerListIfItIsNot");
@@ -490,9 +494,13 @@
                        replicate +"', '"+dataReplicate+"','"+ hub + "')");*/
         pStmt = dbConn.prepareStatement("INSERT INTO xml_replication " +
                       "(server, last_checked, replicate, datareplicate, hub) "+
-                       "VALUES ('" + givenServerName + "', "+
-                        DatabaseService.getInstance().getDBAdapter().toDate("01/01/1980","MM/DD/YYYY") + ", '" +
-                       replicate +"', '"+dataReplicate+"','"+ hub + "')");
+                       "VALUES (?, ?, ?, ?, ?, ?)");
+        pStmt.setString(1, givenServerName);
+		pStmt.setTimestamp(2, new Timestamp(cal.getTimeInMillis()) );
+        pStmt.setInt(3, replicate);
+        pStmt.setInt(4, dataReplicate);
+        pStmt.setInt(5, hub);
+
         pStmt.execute();
        
         pStmt.close();
