Question

You inherit a legacy Java data-access layer where SQL queries are built with raw string concatenation of user-supplied values (e.g., "SELECT * FROM users WHERE name = '" + name + "'"). You highlight one such method and ask Copilot Chat to modernize it. Which instruction is most likely to produce a secure, maintainable result rather than merely reformatting the existing code?

Accepted Answer

"Refactor this method to use a PreparedStatement with parameterized placeholders, binding each user input as a parameter instead of concatenating it into the query string."

Answer

"Clean up this method and make the SQL string easier to read."

Answer

"Escape all single quotes in the name variable before adding it to the query string."

Answer

"Convert this method to use the newest Java syntax features available."