diff --git a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01011.java b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01011.java
index 9d4e34da..ec4b85e3 100644
--- a/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01011.java
+++ b/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01011.java
@@ -64,12 +64,14 @@ public void doPost(HttpServletRequest request, HttpServletResponse response)
 
         String bar = new Test().doSomething(request, param);
 
-        String sql = "SELECT * from USERS where USERNAME='foo' and PASSWORD='" + bar + "'";
+        String sql = "SELECT * from USERS where USERNAME='foo' and PASSWORD=?";
 
         try {
-            java.sql.Statement statement =
-                    org.owasp.benchmark.helpers.DatabaseHelper.getSqlStatement();
-            statement.addBatch(sql);
+            java.sql.Connection connection =
+                    org.owasp.benchmark.helpers.DatabaseHelper.getSqlStatement().getConnection();
+            java.sql.PreparedStatement statement = connection.prepareStatement(sql);
+            statement.setString(1, bar);
+            statement.addBatch();
             int[] counts = statement.executeBatch();
             org.owasp.benchmark.helpers.DatabaseHelper.printResults(sql, counts, response);
         } catch (java.sql.SQLException e) {