Index: test/edu/ucsb/nceas/MCTestCase.java
===================================================================
--- test/edu/ucsb/nceas/MCTestCase.java	(revision 6605)
+++ test/edu/ucsb/nceas/MCTestCase.java	(revision 6606)
@@ -25,8 +25,6 @@
 
 package edu.ucsb.nceas;
 
-import junit.framework.TestCase;
-
 import java.io.BufferedReader;
 import java.io.File;
 import java.io.FileReader;
@@ -38,26 +36,22 @@
 import java.sql.ResultSet;
 import java.sql.ResultSetMetaData;
 import java.sql.SQLException;
-import java.sql.Statement;
-import java.util.Calendar;
-import java.util.Date;
-import java.util.GregorianCalendar;
 import java.util.HashMap;
 import java.util.Hashtable;
-import java.util.SimpleTimeZone;
-import java.util.TimeZone;
 import java.util.Vector;
 
+import junit.framework.TestCase;
+
 import org.apache.http.client.HttpClient;
 import org.apache.http.impl.client.DefaultHttpClient;
 
-import edu.ucsb.nceas.metacat.database.DBConnection;
-import edu.ucsb.nceas.metacat.database.DBConnectionPool;
 import edu.ucsb.nceas.metacat.client.InsufficientKarmaException;
 import edu.ucsb.nceas.metacat.client.Metacat;
 import edu.ucsb.nceas.metacat.client.MetacatException;
 import edu.ucsb.nceas.metacat.client.MetacatFactory;
 import edu.ucsb.nceas.metacat.client.MetacatInaccessibleException;
+import edu.ucsb.nceas.metacat.database.DBConnection;
+import edu.ucsb.nceas.metacat.database.DBConnectionPool;
 import edu.ucsb.nceas.metacat.properties.PropertyService;
 import edu.ucsb.nceas.metacat.shared.ServiceException;
 import edu.ucsb.nceas.metacat.util.DocumentUtil;
@@ -508,14 +502,12 @@
 	protected static void dbQuery(String sqlStatement, String methodName)
 			throws SQLException {
 
-		DBConnectionPool connPool = DBConnectionPool.getInstance();
 		DBConnection dbconn = DBConnectionPool.getDBConnection(methodName);
 		int serialNumber = dbconn.getCheckOutSerialNumber();
 
-		Statement statement = dbconn.createStatement();
-
+		PreparedStatement statement = dbconn.prepareStatement(sqlStatement);
 		debug("Executing against db: " + sqlStatement);
-		statement.executeQuery(sqlStatement);
+		statement.executeQuery();
 
 		statement.close();
 		
@@ -525,15 +517,12 @@
 	protected static void dbUpdate(String sqlStatement, String methodName)
 			throws SQLException {
 
-		DBConnectionPool connPool = DBConnectionPool.getInstance();
 		DBConnection dbconn = DBConnectionPool.getDBConnection(methodName);
 		int serialNumber = dbconn.getCheckOutSerialNumber();
 
-		Statement statement = dbconn.createStatement();
-
+		PreparedStatement statement = dbconn.prepareStatement(sqlStatement);
 		debug("Executing against db: " + sqlStatement);
-		statement.executeUpdate(sqlStatement);
-
+		statement.executeUpdate();
 		statement.close();
 
 		DBConnectionPool.returnDBConnection(dbconn, serialNumber);
Index: src/edu/ucsb/nceas/metacat/accesscontrol/AccessControlList.java
===================================================================
--- src/edu/ucsb/nceas/metacat/accesscontrol/AccessControlList.java	(revision 6605)
+++ src/edu/ucsb/nceas/metacat/accesscontrol/AccessControlList.java	(revision 6606)
@@ -27,32 +27,32 @@
 
 package edu.ucsb.nceas.metacat.accesscontrol;
 
-import java.io.*;
-import java.sql.*;
+import java.io.IOException;
+import java.io.StringReader;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
 import java.util.Stack;
 import java.util.Vector;
 
 import org.apache.log4j.Logger;
 import org.xml.sax.Attributes;
-import org.xml.sax.InputSource;
 import org.xml.sax.ContentHandler;
 import org.xml.sax.EntityResolver;
 import org.xml.sax.ErrorHandler;
+import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
 import org.xml.sax.XMLReader;
+import org.xml.sax.helpers.DefaultHandler;
 import org.xml.sax.helpers.XMLReaderFactory;
-import org.xml.sax.helpers.DefaultHandler;
 
 import edu.ucsb.nceas.metacat.BasicNode;
 import edu.ucsb.nceas.metacat.DBEntityResolver;
 import edu.ucsb.nceas.metacat.DocumentImpl;
 import edu.ucsb.nceas.metacat.McdbException;
-import edu.ucsb.nceas.metacat.PermissionController;
 import edu.ucsb.nceas.metacat.database.DBConnection;
 import edu.ucsb.nceas.metacat.database.DBConnectionPool;
 import edu.ucsb.nceas.metacat.properties.PropertyService;
-import edu.ucsb.nceas.metacat.shared.AccessException;
-import edu.ucsb.nceas.metacat.util.MetacatUtil;
 import edu.ucsb.nceas.metacat.util.SystemUtil;
 import edu.ucsb.nceas.utilities.PropertyNotFoundException;
 
@@ -478,19 +478,20 @@
   {
     //DBConnection conn = null;
     //int serialNumber = -1;
-    Statement stmt = null;
+    PreparedStatement pstmt = null;
     try
     {
       //check out DBConenction
       //conn=DBConnectionPool.getDBConnection("AccessControlList.deltePerm");
       //serialNumber=conn.getCheckOutSerialNumber();
+    	String sql = "DELETE FROM xml_access WHERE accessfileid = ?";
       // delete all acl records for resources related to @aclid if any
-      stmt = connection.createStatement();
+      pstmt = connection.prepareStatement(sql);
+      pstmt.setString(1, aclid);
       // Increase DBConnection usage count
       connection.increaseUsageCount(1);
-      logMetacat.debug("running sql: " + stmt.toString());
-      stmt.execute("DELETE FROM xml_access WHERE accessfileid = '" + aclid 
-                                                                      + "'");
+      logMetacat.debug("running sql: " + pstmt.toString());
+      pstmt.execute();
       //increase usageCount!!!!!!
       //conn.increaseUsageCount(1);
     }
@@ -500,7 +501,7 @@
     }
     finally
     {
-      stmt.close();
+      pstmt.close();
       //retrun DBConnection
       //DBConnectionPool.returnDBConnection(conn,serialNumber);
     }
Index: src/edu/ucsb/nceas/metacat/DocumentImpl.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DocumentImpl.java	(revision 6605)
+++ src/edu/ucsb/nceas/metacat/DocumentImpl.java	(revision 6606)
@@ -43,7 +43,6 @@
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
-import java.sql.Statement;
 import java.sql.Timestamp;
 import java.util.Calendar;
 import java.util.Date;
@@ -3420,11 +3419,11 @@
                                  throws SQLException
     {
       String type = null;
-      String sql = "SELECT DOCTYPE FROM xml_documents WHERE docid LIKE " + "'" +
-                    docidWithoutRev +"'";
-      Statement stmt = null;
-      stmt = conn.createStatement();
-      ResultSet result = stmt.executeQuery(sql);
+      String sql = "SELECT DOCTYPE FROM xml_documents WHERE docid LIKE ?";
+      PreparedStatement stmt = null;
+      stmt = conn.prepareStatement(sql);
+      stmt.setString(1, docidWithoutRev);
+      ResultSet result = stmt.executeQuery();
       boolean hasResult = result.next();
       if (hasResult)
       {
Index: src/edu/ucsb/nceas/metacat/DBSAXNode.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DBSAXNode.java	(revision 6605)
+++ src/edu/ucsb/nceas/metacat/DBSAXNode.java	(revision 6606)
@@ -29,7 +29,6 @@
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
-import java.sql.Statement;
 import java.util.Enumeration;
 import java.util.Hashtable;
 
@@ -356,7 +355,7 @@
   /** get next node id from DB connection */
   private long generateNodeID() throws SAXException {
       long nid=0;
-      Statement stmt;
+      PreparedStatement pstmt;
       DBConnection dbConn = null;
       int serialNumber = -1;
       try {
@@ -363,14 +362,15 @@
         // Get DBConnection
         dbConn=DBConnectionPool.getDBConnection("DBSAXNode.generateNodeID");
         serialNumber=dbConn.getCheckOutSerialNumber();
-        stmt = dbConn.createStatement();
-        stmt.execute("SELECT xml_nodes_id_seq.nextval FROM dual");
-        ResultSet rs = stmt.getResultSet();
+        String sql = "SELECT xml_nodes_id_seq.nextval FROM dual";
+        pstmt = dbConn.prepareStatement(sql);
+        pstmt.execute();
+        ResultSet rs = pstmt.getResultSet();
         boolean tableHasRows = rs.next();
         if (tableHasRows) {
           nid = rs.getLong(1);
         }
-        stmt.close();
+        pstmt.close();
       } catch (SQLException e) {
         System.out.println("Error in DBSaxNode.generateNodeID: " +
                             e.getMessage());
Index: src/edu/ucsb/nceas/metacat/EML201DocumentCorrector.java
===================================================================
--- src/edu/ucsb/nceas/metacat/EML201DocumentCorrector.java	(revision 6605)
+++ src/edu/ucsb/nceas/metacat/EML201DocumentCorrector.java	(revision 6606)
@@ -1,6 +1,6 @@
 package edu.ucsb.nceas.metacat;
 
-import java.sql.Statement;
+import java.sql.PreparedStatement;
 
 import org.apache.log4j.Logger;
 
@@ -50,26 +50,29 @@
     	           //checkout the dbconnection
     	          dbconn = DBConnectionPool.getDBConnection("EML201DocumentCorrector.run");
     	          serialNumber = dbconn.getCheckOutSerialNumber();
-    	          Statement deletingStatement = dbconn.createStatement();
+    	          PreparedStatement deletingStatement = null;
     	         
     	          // delete the records in xml_index table 
     	          String deletingIndex = generateXML_IndexDeletingSQL();
     	          logMetacat.debug("EML201DocumentCorrector.run - deleting the records in xml_index table with sql: " + deletingIndex);
-    	          deletingStatement.execute(deletingIndex);
+    	          deletingStatement = dbconn.prepareStatement(deletingIndex);
+    	          deletingStatement.execute();
+    	          deletingStatement.close();
     	          
     	          // delete the records in xml_nodes table
     	          String deletingNode = generateXML_NodeDeletingSQL();
     	          logMetacat.debug("EML201DocumentCorrector.run - deleting the records in xml_nodes table with sql: " + deletingNode);
-    	          deletingStatement.execute(deletingNode);
+    	          deletingStatement = dbconn.prepareStatement(deletingNode);
+    	          deletingStatement.execute();
+    	          deletingStatement.close();
     	          
     	          // delete the records in xml_nodes_revisions table
     	          String deletingNodeRevision = generateXML_Node_RevisionsDeletingSQL();
     	          logMetacat.debug("EML201DocumentCorrector.run - deleting the records in xml_nodes_revisions table with sql: " + deletingNodeRevision);
-    	          deletingStatement.execute(deletingNodeRevision);
+    	          deletingStatement = dbconn.prepareStatement(deletingNodeRevision);
+    	          deletingStatement.execute();
+    	          deletingStatement.close();
     	          
-    	          //close statement and connection
-    	          deletingStatement.close();
-    	          //dbconn.close();
     	          success = true;
     	      }
     	        catch (Exception ee)
Index: src/edu/ucsb/nceas/metacat/database/DBConnection.java
===================================================================
--- src/edu/ucsb/nceas/metacat/database/DBConnection.java	(revision 6605)
+++ src/edu/ucsb/nceas/metacat/database/DBConnection.java	(revision 6606)
@@ -411,6 +411,8 @@
   
   /**
    * Method to create a Statement
+   * @deprecated PreparedStatements are preferred so as to encourage 
+   * parameter value binding
    */
   public Statement createStatement() throws SQLException
   {
Index: src/edu/ucsb/nceas/metacat/DBSAXHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DBSAXHandler.java	(revision 6605)
+++ src/edu/ucsb/nceas/metacat/DBSAXHandler.java	(revision 6606)
@@ -27,6 +27,7 @@
 
 package edu.ucsb.nceas.metacat;
 
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.Statement;
 import java.util.Date;
@@ -361,21 +362,22 @@
                                 .getDBConnection("DBSAXHandler.startElement");
                         serialNumber = dbConn.getCheckOutSerialNumber();
 
-                        Statement stmt = dbConn.createStatement();
-                        ResultSet rs = stmt
-                                .executeQuery("SELECT catalog_id FROM xml_catalog "
-                                        + "WHERE entry_type = 'DTD' "
-                                        + "AND public_id = '" + doctype + "'");
+                        String sql = "SELECT catalog_id FROM xml_catalog "
+                            + "WHERE entry_type = 'DTD' "
+                            + "AND public_id = ?";
+                        	
+                        PreparedStatement pstmt = dbConn.prepareStatement(sql);
+                        pstmt.setString(1, doctype);
+                        ResultSet rs = pstmt.executeQuery();
                         boolean hasRow = rs.next();
                         if (hasRow) {
                             catalogid = rs.getString(1);
                         }
-                        stmt.close();
+                        pstmt.close();
                     }//try
                     finally {
                         // Return dbconnection
-                        DBConnectionPool.returnDBConnection(dbConn,
-                                serialNumber);
+                        DBConnectionPool.returnDBConnection(dbConn, serialNumber);
                     }//finally
                 }
 
Index: src/edu/ucsb/nceas/metacat/DBEntityResolver.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DBEntityResolver.java	(revision 6605)
+++ src/edu/ucsb/nceas/metacat/DBEntityResolver.java	(revision 6606)
@@ -217,7 +217,7 @@
                  throws SAXException
   {
     String systemid = null;
-    Statement stmt = null;
+    PreparedStatement pstmt = null;
     DBConnection conn = null;
     int serialNumber = -1;
     try {
@@ -225,11 +225,14 @@
       conn=DBConnectionPool.getDBConnection("DBEntityResolver.getDTDSystemID");
       serialNumber=conn.getCheckOutSerialNumber();
 
-      stmt = conn.createStatement();
-      stmt.execute("SELECT system_id FROM xml_catalog " +
-                   "WHERE entry_type = 'DTD' AND public_id = '" +
-                   doctype + "'");
-      ResultSet rs = stmt.getResultSet();
+      String sql = "SELECT system_id FROM xml_catalog " +
+      "WHERE entry_type = 'DTD' AND public_id = ?";
+      
+      pstmt = conn.prepareStatement(sql);
+      pstmt.setString(1, doctype);
+      
+      pstmt.execute();
+      ResultSet rs = pstmt.getResultSet();
       boolean tableHasRows = rs.next();
       if (tableHasRows) {
         systemid = rs.getString(1);
@@ -238,7 +241,7 @@
         	systemid = SystemUtil.getContextURL() + systemid;
         }
       }
-      stmt.close();
+      pstmt.close();
     } catch (SQLException e) {
       throw new SAXException
       ("DBEntityResolver.getDTDSystemID - SQL error when getting DTD system ID: " + e.getMessage());
@@ -250,7 +253,7 @@
     {
       try
       {
-        stmt.close();
+        pstmt.close();
       }//try
       catch (SQLException sqlE)
       {
Index: src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java	(revision 6605)
+++ src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java	(revision 6606)
@@ -41,7 +41,6 @@
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
-import java.sql.Statement;
 import java.util.Date;
 import java.util.EmptyStackException;
 import java.util.Enumeration;
@@ -742,16 +741,17 @@
                                 .getDBConnection("DBSAXHandler.startElement");
                         serialNumber = dbConn.getCheckOutSerialNumber();
 
-                        Statement stmt = dbConn.createStatement();
-                        ResultSet rs = stmt
-                                .executeQuery("SELECT catalog_id FROM xml_catalog "
-                                        + "WHERE entry_type = 'Schema' "
-                                        + "AND public_id = '" + doctype + "'");
+                        String sql = "SELECT catalog_id FROM xml_catalog "
+                            + "WHERE entry_type = 'Schema' "
+                            + "AND public_id = ?";
+                        PreparedStatement pstmt = dbConn.prepareStatement(sql);
+                        pstmt.setString(1, doctype);
+                        ResultSet rs = pstmt.executeQuery();
                         boolean hasRow = rs.next();
                         if (hasRow) {
                             catalogid = rs.getString(1);
                         }
-                        stmt.close();
+                        pstmt.close();
                         //System.out.println("here!!!!!!!!!!!!!!!!!!2");
                     }//try
                     finally {
@@ -2169,20 +2169,21 @@
     private void deletePermissionsInAccessTableForDoc(String docid)
             throws SAXException
     {
-        Statement stmt = null;
+        PreparedStatement pstmt = null;
         try {
+        	String sql = "DELETE FROM xml_access WHERE docid = ?";
             // delete all acl records for resources related to @aclid if any
-            stmt = connection.createStatement();
+            pstmt = connection.prepareStatement(sql);
+            pstmt.setString(1, docid);
             // Increase DBConnection usage count
             connection.increaseUsageCount(1);
-            stmt.execute("DELETE FROM xml_access WHERE docid = '"
-                    + docid + "'");
+            pstmt.execute();
 
         } catch (SQLException e) {
             throw new SAXException(e.getMessage());
         } finally {
             try {
-                stmt.close();
+                pstmt.close();
             } catch (SQLException ee) {
                 throw new SAXException(ee.getMessage());
             }
@@ -2192,14 +2193,19 @@
     /* Delete access rules from xml_access for a subtee id */
     private void deleteSubtreeAccessRule(String subtreeid) throws SAXException
     {
-      Statement stmt = null;
+      PreparedStatement pstmt = null;
        try
        {
-           stmt = connection.createStatement();
+    	   String sql = 
+    		   "DELETE FROM xml_access " +
+    		   "WHERE accessfileid = ? " +
+               "AND subtreeid = ?";
+           pstmt = connection.prepareStatement(sql);
+           pstmt.setString(1, docid);
+           pstmt.setString(2, subtreeid);
            // Increase DBConnection usage count
            connection.increaseUsageCount(1);
-           stmt.execute("DELETE FROM xml_access WHERE accessfileid = '"
-                   + docid + "' AND subtreeid ='" + subtreeid +"'");
+           pstmt.execute();
        }
        catch (SQLException e)
        {
@@ -2209,7 +2215,7 @@
        {
            try
            {
-               stmt.close();
+               pstmt.close();
            }
            catch (SQLException ee)
            {
@@ -2221,14 +2227,17 @@
 
     private void deleteAllInlineDataAccessRules() throws SAXException
     {
-      Statement stmt = null;
+      PreparedStatement pstmt = null;
        try
        {
-           stmt = connection.createStatement();
+    	   String sql = 
+    		   "DELETE FROM xml_access " +
+    		   "WHERE accessfileid = ? AND subtreeid IS NOT NULL";
+           pstmt = connection.prepareStatement(sql);
+           pstmt.setString(1, docid);
            // Increase DBConnection usage count
            connection.increaseUsageCount(1);
-           stmt.execute("DELETE FROM xml_access WHERE accessfileid = '"
-                   + docid + "' AND subtreeid IS NOT NULL");
+           pstmt.execute();
        }
        catch (SQLException e)
        {
@@ -2238,7 +2247,7 @@
        {
            try
            {
-               stmt.close();
+               pstmt.close();
            }
            catch (SQLException ee)
            {
@@ -2349,22 +2358,22 @@
     /* Delete every access subtree record from xml_accesssubtree. */
     private void deleteAccessSubTreeRecord(String docId) throws SAXException
     {
-        Statement stmt = null;
+        PreparedStatement pstmt = null;
         try {
+        	String sql = "DELETE FROM xml_accesssubtree WHERE docid = ?";
             // delete all acl records for resources related to @aclid if any
-            stmt = connection.createStatement();
+            pstmt = connection.prepareStatement(sql);
+            pstmt.setString(1, docId);
             // Increase DBConnection usage count
             connection.increaseUsageCount(1);                   
-            logMetacat.debug("running sql: DELETE FROM xml_accesssubtree WHERE docid = '"
-                    + docId + "'");
-            stmt.execute("DELETE FROM xml_accesssubtree WHERE docid = '"
-                    + docId + "'");
+            logMetacat.debug("running sql: " + sql);
+            pstmt.execute();
 
         } catch (SQLException e) {
             throw new SAXException(e.getMessage());
         } finally {
             try {
-                stmt.close();
+                pstmt.close();
             } catch (SQLException ee) {
                 throw new SAXException(ee.getMessage());
             }
Index: src/edu/ucsb/nceas/metacat/Eml210SAXHandler.java
===================================================================
--- src/edu/ucsb/nceas/metacat/Eml210SAXHandler.java	(revision 6605)
+++ src/edu/ucsb/nceas/metacat/Eml210SAXHandler.java	(revision 6606)
@@ -35,7 +35,6 @@
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
-import java.sql.Statement;
 import java.util.Date;
 import java.util.EmptyStackException;
 import java.util.Enumeration;
@@ -385,17 +384,18 @@
 						dbConn = DBConnectionPool
 								.getDBConnection("DBSAXHandler.startElement");
 						serialNumber = dbConn.getCheckOutSerialNumber();
-
-						Statement stmt = dbConn.createStatement();
-						ResultSet rs = stmt
-								.executeQuery("SELECT catalog_id FROM xml_catalog "
-										+ "WHERE entry_type = 'Schema' "
-										+ "AND public_id = '" + doctype + "'");
+						
+						String sql = "SELECT catalog_id FROM xml_catalog "
+							+ "WHERE entry_type = 'Schema' "
+							+ "AND public_id = ?";
+						PreparedStatement pstmt = dbConn.prepareStatement(sql);
+						pstmt.setString(1, doctype);
+						ResultSet rs = pstmt.executeQuery();
 						boolean hasRow = rs.next();
 						if (hasRow) {
 							catalogid = rs.getString(1);
 						}
-						stmt.close();
+						pstmt.close();
 					}// try
 					finally {
 						// Return dbconnection
@@ -1570,21 +1570,22 @@
 
 	/* Delete from db all permission for resources related to @aclid if any. */
 	private void deletePermissionsInAccessTable(String aclid) throws SAXException {
-		Statement stmt = null;
+		PreparedStatement pstmt = null;
 		try {
+			String sql = "DELETE FROM xml_access WHERE accessfileid = '" + aclid + "'";
 			// delete all acl records for resources related to @aclid if any
-			stmt = connection.createStatement();
+			pstmt = connection.prepareStatement(sql);
+			pstmt.setString(1, aclid);
 			// Increase DBConnection usage count
 			connection.increaseUsageCount(1);
-			logMetacat.debug("running sql: DELETE FROM xml_access WHERE accessfileid = '"
-					+ aclid + "'");
-			stmt.execute("DELETE FROM xml_access WHERE accessfileid = '" + aclid + "'");
+			logMetacat.debug("running sql: " + sql);
+			pstmt.execute();
 
 		} catch (SQLException e) {
 			throw new SAXException(e.getMessage());
 		} finally {
 			try {
-				stmt.close();
+				pstmt.close();
 			} catch (SQLException ee) {
 				throw new SAXException(ee.getMessage());
 			}
@@ -1648,21 +1649,22 @@
 
 	/* Delete every access subtree record from xml_accesssubtree. */
 	private void deleteAccessSubTreeRecord(String docId) throws SAXException {
-		Statement stmt = null;
+		PreparedStatement pstmt = null;
 		try {
+			String sql = "DELETE FROM xml_accesssubtree WHERE docid = ?";
 			// delete all acl records for resources related to @aclid if any
-			stmt = connection.createStatement();
+			pstmt = connection.prepareStatement(sql);
+			pstmt.setString(1, docId);
 			// Increase DBConnection usage count
 			connection.increaseUsageCount(1);
-			logMetacat.debug("running sql: DELETE FROM xml_accesssubtree WHERE docid = '"
-					+ docId + "'");
-			stmt.execute("DELETE FROM xml_accesssubtree WHERE docid = '" + docId + "'");
+			logMetacat.debug("running sql: " + sql);
+			pstmt.execute();
 
 		} catch (SQLException e) {
 			throw new SAXException(e.getMessage());
 		} finally {
 			try {
-				stmt.close();
+				pstmt.close();
 			} catch (SQLException ee) {
 				throw new SAXException(ee.getMessage());
 			}
