diff --git a/WebContent/high_yield_investments.htm b/WebContent/high_yield_investments.htm
index 715a931..4a8a5a2 100644
--- a/WebContent/high_yield_investments.htm
+++ b/WebContent/high_yield_investments.htm
@@ -124,7 +124,7 @@ <h1>High Yield Investments</h1>
         if any, to third party products and/or websites are purely coincidental. This site is
         provided "as is" without warranty of any kind, either express or implied. Watchfire does
         not assume any risk in relation to your use of this website. For additional Terms of Use,
-        please go to <a id="_ctl0__ctl0_HyperLink7" href="http://www.watchfire.com/statements/terms.aspx">http://www.watchfire.com/statements/terms.aspx</a>.<br /><br />
+        please go to <a id="_ctl0__ctl0_HyperLink7" href="https://www.watchfire.com/statements/terms.aspx">https://www.watchfire.com/statements/terms.aspx</a>.<br /><br />
 
         Copyright &copy; 2006, Watchfire Corporation, All rights reserved.
     </div>
diff --git a/WebContent/static/inside_about.htm b/WebContent/static/inside_about.htm
index cd5517e..345c400 100644
--- a/WebContent/static/inside_about.htm
+++ b/WebContent/static/inside_about.htm
@@ -9,7 +9,7 @@ <h1>About Altoro Mutual</h1>
 <ul>
     <li><a href="index.jsp?content=inside_executives.htm">Executives & Management Team</a></li>
     <li><a href="index.jsp?content=inside_community.htm">Community Affairs</a></li>
-    <li><a href="http://www.newspapersyndications.tv">Analyst Reviews</a></li>
+    <li><a href="https://www.newspapersyndications.tv">Analyst Reviews</a></li>
     <li><a href="inside_points_of_interest.htm">Points of Interest</a></li>
 </ul>
 
@@ -22,4 +22,4 @@ <h1>About Altoro Mutual</h1>
 <span class="credit">
 Altoro Mutual offers a broad range of commercial, private, retail and mortgage banking services to small- and middle-market businesses and individuals.</span>
 
-</div>
\ No newline at end of file
+</div>
diff --git a/WebContent/static/inside_community.htm b/WebContent/static/inside_community.htm
index a10d665..be0a435 100644
--- a/WebContent/static/inside_community.htm
+++ b/WebContent/static/inside_community.htm
@@ -9,9 +9,9 @@ <h2>Volunteering</h2>
 <p>The employees of Altoro Mutual not only give millions of dollars in donations but thousands of hours of volunteer time to their communities each year. Learn about our current <a href="index.jsp?content=inside_volunteering.htm">volunteer programs</a>.</p>
 
 <h2>Summer 2006</h2>
-<p>The 2006 community efforts of Altoro Mutual and our employees is quite impressive including charitable contributions, volunteerism, diversity initiatives, and other support.  <a href="pr/communityannualreport.pdf">View</a> the summary report (PDF, 800KB).</p>
+<p>The 2006 community efforts of Altoro Mutual and our employees is quite impressive including charitable contributions, volunteerism, diversity initiatives, and other support.  <a href="https://pr/communityannualreport.pdf">View</a> the summary report (PDF, 800KB).</p>
 
 <p><img src="images/adobe.gif" border=0 alt="Adobe Reader"><br />
-<a href="http://www.adobe.com/products/acrobat/readstep2.html">Download free Adobe Reader</a>.</p>
+<a href="https://www.adobe.com/products/acrobat/readstep2.html">Download free Adobe Reader</a>.</p>
 
-</div>
\ No newline at end of file
+</div>
diff --git a/WebContent/static/security.htm b/WebContent/static/security.htm
index 42646c0..b107860 100644
--- a/WebContent/static/security.htm
+++ b/WebContent/static/security.htm
@@ -56,7 +56,7 @@ <h2>Keep Your System Up to Date</h2>
 <h2>Backups</h2>
 <p>It is a good practice to back up important files and folders on your computer. To back up files, you can make copies onto media that you can safely store elsewhere, such as CDs or floppy discs. </p>
 
-<p>For more information on home computer security, visit <a href="http://www.cert.org/">http://www.cert.org/</a>.</p>
+<p>For more information on home computer security, visit <a href="https://www.cert.org/">https://www.cert.org/</a>.</p>
 <p><a href="#top"><img alt="Back to Top" src="images/icon_top.gif" border="0" /></a>
 
 </div>
\ No newline at end of file
diff --git a/WebContent/swagger/lib/marked.js b/WebContent/swagger/lib/marked.js
index c2a678d..65b679c 100644
--- a/WebContent/swagger/lib/marked.js
+++ b/WebContent/swagger/lib/marked.js
@@ -308,7 +308,7 @@ Lexer.prototype.token = function(src, top, bq) {
         if (~item.indexOf('\n ')) {
           space -= item.length;
           item = !this.options.pedantic
-            ? item.replace(new RegExp('^ {1,' + space + '}', 'gm'), '')
+            ? item.replace(/^ {1,10}/gm, '')
             : item.replace(/^ {1,4}/gm, '');
         }
 
@@ -1095,14 +1095,12 @@ function unescape(html) {
   });
 }
 
-function replace(regex, opt) {
-  regex = regex.source;
-  opt = opt || '';
+function replace(regexPattern, opt) {
   return function self(name, val) {
-    if (!name) return new RegExp(regex, opt);
+    if (!name) return new RegExp(regexPattern, 'gi');
     val = val.source || val;
     val = val.replace(/(^|[^\[])\^/g, '$1');
-    regex = regex.replace(name, val);
+    regexPattern = regexPattern.replace(name, val);
     return self;
   };
 }
diff --git a/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java b/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
index bcc1c94..4030018 100644
--- a/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
+++ b/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
@@ -115,9 +115,12 @@ else if (request.getRequestURL().toString().endsWith("changePassword")){
 		else
 			message = "Requested operation has completed successfully.";
 		
-		request.getSession().setAttribute("message", message);
+		request.getSession().setAttribute("message", sanitizeInput(message));
 		response.sendRedirect("admin.jsp");
 		return ;
 	}
 
+	private String sanitizeInput(String input) {
+		return input.replace("<", "&lt;").replace(">", "&gt;");
+	}
 }
diff --git a/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java b/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
index 55303c3..d537210 100644
--- a/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
+++ b/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
@@ -20,7 +20,7 @@
 import java.io.IOException;
 
 import javax.servlet.ServletException;
-import javax.servlet.http.Cookie;
+import javax.servlet.http_COOKIE;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -36,8 +36,8 @@
  * @author Alexei
  */
 public class LoginServlet extends HttpServlet {
-	private static final long serialVersionUID = 1L;
-	
+    private static final long serialVersionUID = 1L;
+    
     /**
      * @see HttpServlet#HttpServlet()
      */
@@ -45,63 +45,65 @@ public LoginServlet() {
         super();
     }
 
-	/**
-	 * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
-	 */
-	protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
-		//log out
-		try {
-			HttpSession session = request.getSession(false);
-			session.removeAttribute(ServletUtil.SESSION_ATTR_USER);
-		} catch (Exception e){
-			// do nothing
-		} finally {
-			response.sendRedirect("index.jsp");
-		}
-		
-	}
+    /**
+     * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
+     */
+    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        //log out
+        try {
+            HttpSession session = request.getSession(false);
+            session.removeAttribute(ServletUtil.SESSION_ATTR_USER);
+        } catch (Exception e){
+            // do nothing
+        } finally {
+            response.sendRedirect("index.jsp");
+        }
+        
+    }
 
-	/**
-	 * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
-	 */
-	protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
-		//log in
-		// Create session if there isn't one:
-		HttpSession session = request.getSession(true);
+    /**
+     * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
+     */
+    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
+        //log in
+        // Create session if there isn't one:
+        HttpSession session = request.getSession(true);
 
-		String username = null;
-		
-		try {
-			username = request.getParameter("uid");
-			if (username != null)
-				username = username.trim().toLowerCase();
-			
-			String password = request.getParameter("passw");
-			password = password.trim().toLowerCase(); //in real life the password usually is case sensitive and this cast would not be done
-			
-			if (!DBUtil.isValidUser(username, password)){
-				Log4AltoroJ.getInstance().logError("Login failed >>> User: " +username + " >>> Password: " + password);
-				throw new Exception("Login Failed: We're sorry, but this username or password was not found in our system. Please try again.");
-			}
-		} catch (Exception ex) {
-			request.getSession(true).setAttribute("loginError", ex.getLocalizedMessage());
-			response.sendRedirect("login.jsp");
-			return;
-		}
+        String username = null;
+        
+        try {
+            username = request.getParameter("uid");
+            if (username != null)
+                username = username.trim().toLowerCase();
+            
+            String password = request.getParameter("passw");
+            password = password.trim().toLowerCase(); //in real life the password usually is case sensitive and this cast would not be done
+            
+            if (!DBUtil.isValidUser(username, password)){
+                Log4AltoroJ.getInstance().logError("Login failed >>> User: " +username + " >>> Password: " + password);
+                throw new Exception("Login Failed: We're sorry, but this username or password was not found in our system. Please try again.");
+            }
+        } catch (Exception ex) {
+            request.getSession(true).setAttribute("loginError", ex.getLocalizedMessage());
+            response.sendRedirect("login.jsp");
+            return;
+        }
 
-		//Handle the cookie using ServletUtil.establishSession(String)
-		try{
-			Cookie accountCookie = ServletUtil.establishSession(username,session);
-			response.addCookie(accountCookie);
-			response.sendRedirect(request.getContextPath()+"/bank/main.jsp");
-			}
-		catch (Exception ex){
-			ex.printStackTrace();
-			response.sendError(500);
-		}
-			
-		
-		return;
-	}
+        //Handle the cookie using ServletUtil.establishSession(String)
+        try{
+            Cookie accountCookie = ServletUtil.establishSession(username,session);
+            accountCookie.setHttpOnly(true);
+            accountCookie.setSecure(true);            
+            response.addCookie(accountCookie);
+            response.sendRedirect(request.getContextPath()+"/bank/main.jsp");
+            }
+        catch (Exception ex){
+            ex.printStackTrace();
+            response.sendError(500);
+        }
+            
+        
+        return;
+    }
 
 }
diff --git a/src/com/ibm/security/appscan/altoromutual/servlet/SurveyServlet.java b/src/com/ibm/security/appscan/altoromutual/servlet/SurveyServlet.java
index 40b8984..922b8e1 100644
--- a/src/com/ibm/security/appscan/altoromutual/servlet/SurveyServlet.java
+++ b/src/com/ibm/security/appscan/altoromutual/servlet/SurveyServlet.java
@@ -95,10 +95,23 @@ else if (step.equals("done")){
 			content = "<h1>Request Out of Order</h1>"+
 			"<div width=\"99%\"><p>It appears that you attempted to skip or repeat some areas of this survey.  Please <a href=\"survey_questions.jsp\">return to the start page</a> to begin again.</p></div>";
 		} else {		
-			request.getSession().setAttribute("surveyStep", step);
+			import org.owasp.esapi.codecs.OracleCodec;
+			import org.owasp.esapi.errors.ValidationException;
+			import org.owasp.esapi.reference.DefaultValidator;
+			
+			...
+			
+			String canonicalStep;
+			try {
+			    canonicalStep = DefaultValidator.getValidInput("SurveyStep", step, "^[a-zA-Z0-9_-]{1,20}$", 20);
+			} catch (ValidationException e) {
+			    throw new RuntimeException("Invalid input", e);
+			}
+			
+			request.getSession().setAttribute("surveyStep", canonicalStep);
 		}
 		response.setContentType("text/html");
-		response.getWriter().write(content);
+    response.getWriter().write(String.valueOf(HtmlUtils.htmlEscape(content)));
 		response.getWriter().flush();
 		
 	}
diff --git a/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java b/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
index 3031aa8..27ccb14 100644
--- a/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
+++ b/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
@@ -212,16 +212,17 @@ public static ArrayList<Feedback> getFeedback (long feedbackId){
 	public static boolean isValidUser(String user, String password) throws SQLException{
 		if (user == null || password == null || user.trim().length() == 0 || password.trim().length() == 0)
 			return false; 
-		
+			
 		Connection connection = getConnection();
-		Statement statement = connection.createStatement();
+		PreparedStatement statement = connection.prepareStatement("SELECT COUNT(*) FROM PEOPLE WHERE USER_ID = ? AND PASSWORD = ?");
+		statement.setString(1, user);
+		statement.setString(2, password);
 		
-		ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
+		ResultSet resultSet = statement.executeQuery();
 		
 		if (resultSet.next()){
-			
-				if (resultSet.getInt(1) > 0)
-					return true;
+			if (resultSet.getInt(1) > 0)
+				return true;
 		}
 		return false;
 	}
@@ -238,9 +239,10 @@ public static User getUserInfo(String username) throws SQLException{
 			return null; 
 		
 		Connection connection = getConnection();
-		Statement statement = connection.createStatement();
-		ResultSet resultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
-
+		PreparedStatement statement = connection.prepareStatement("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = ? ");
+		statement.setString(1, username);
+		ResultSet resultSet = statement.executeQuery();
+	
 		String firstName = null;
 		String lastName = null;
 		String roleString = null;
@@ -270,11 +272,12 @@ public static User getUserInfo(String username) throws SQLException{
 	public static Account[] getAccounts(String username) throws SQLException{
 		if (username == null || username.trim().length() == 0)
 			return null; 
-		
+			
 		Connection connection = getConnection();
-		Statement statement = connection.createStatement();
-		ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
-
+		PreparedStatement statement = connection.prepareStatement("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = ?"); 
+		statement.setString(1, username);
+		ResultSet resultSet = statement.executeQuery();
+	
 		ArrayList<Account> accounts = new ArrayList<Account>(3);
 		while (resultSet.next()){
 			long accountId = resultSet.getLong("ACCOUNT_ID");
@@ -296,17 +299,16 @@ public static Account[] getAccounts(String username) throws SQLException{
 	 * @return
 	 */
 	public static String transferFunds(String username, long creditActId, long debitActId, double amount) {
-				
+					
 		try {
-			
+				
 			User user = getUserInfo(username);
-			
+				
 			Connection connection = getConnection();
-			Statement statement = connection.createStatement();
-
+			
 			Account debitAccount = Account.getAccount(debitActId);
 			Account creditAccount = Account.getAccount(creditActId);
-
+	
 			if (debitAccount == null){
 				return "Originating account is invalid";
 			} 
@@ -330,11 +332,21 @@ public static String transferFunds(String username, long creditActId, long debit
 			 * (reverse of other accounts). Therefore we have to process balances differently*/
 			if (debitAccount.getAccountId() == userCC)
 				debitAmount = -debitAmount;
-		
+			
 			//create transaction record
-			statement.execute("INSERT INTO TRANSACTIONS (ACCOUNTID, DATE, TYPE, AMOUNT) VALUES ("+debitAccount.getAccountId()+",'"+date+"',"+((debitAccount.getAccountId() == userCC)?"'Cash Advance'":"'Withdrawal'")+","+debitAmount+")," +
-					  "("+creditAccount.getAccountId()+",'"+date+"',"+((creditAccount.getAccountId() == userCC)?"'Payment'":"'Deposit'")+","+creditAmount+")"); 	
-
+			PreparedStatement statement = connection.prepareStatement("INSERT INTO TRANSACTIONS (ACCOUNTID, DATE, TYPE, AMOUNT) VALUES (?, ?, ?, ?), (?, ?, ?, ?)");
+			statement.setLong(1, debitAccount.getAccountId());
+			statement.setTimestamp(2, date);
+			statement.setString(3, debitAccount.getAccountId() == userCC ? "Cash Advance" : "Withdrawal");
+			statement.setDouble(4, debitAmount);
+			
+			statement.setLong(5, creditAccount.getAccountId());
+			statement.setTimestamp(6, date);
+			statement.setString(7, creditAccount.getAccountId() == userCC ? "Payment" : "Deposit");
+			statement.setDouble(8, creditAmount);
+			
+			statement.execute();
+			
 			Log4AltoroJ.getInstance().logTransaction(debitAccount.getAccountId()+" - "+ debitAccount.getAccountName(), creditAccount.getAccountId()+" - "+ creditAccount.getAccountName(), amount);
 			
 			if (creditAccount.getAccountId() == userCC)
@@ -342,14 +354,26 @@ public static String transferFunds(String username, long creditActId, long debit
 			
 			//add cash advance fee since the money transfer was made from the credit card 
 			if (debitAccount.getAccountId() == userCC){
-				statement.execute("INSERT INTO TRANSACTIONS (ACCOUNTID, DATE, TYPE, AMOUNT) VALUES ("+debitAccount.getAccountId()+",'"+date+"','Cash Advance Fee',"+CASH_ADVANCE_FEE+")");
+				PreparedStatement statement2 = connection.prepareStatement("INSERT INTO TRANSACTIONS (ACCOUNTID, DATE, TYPE, AMOUNT) VALUES (?, ?, ?, ?)");
+				statement2.setLong(1, debitAccount.getAccountId());
+				statement2.setTimestamp(2, date);
+				statement2.setString(3, "Cash Advance Fee");
+				statement2.setDouble(4, CASH_ADVANCE_FEE);
+				statement2.execute();
 				debitAmount += CASH_ADVANCE_FEE;
 				Log4AltoroJ.getInstance().logTransaction(String.valueOf(userCC), "N/A", CASH_ADVANCE_FEE);
 			}
-						
+							
 			//update account balances
-			statement.execute("UPDATE ACCOUNTS SET BALANCE = " + (debitAccount.getBalance()+debitAmount) + " WHERE ACCOUNT_ID = " + debitAccount.getAccountId());
-			statement.execute("UPDATE ACCOUNTS SET BALANCE = " + (creditAccount.getBalance()+creditAmount) + " WHERE ACCOUNT_ID = " + creditAccount.getAccountId());
+			PreparedStatement statement3 = connection.prepareStatement("UPDATE ACCOUNTS SET BALANCE = ? WHERE ACCOUNT_ID = ?");
+			statement3.setDouble(1, debitAccount.getBalance()+debitAmount);
+			statement3.setLong(2, debitAccount.getAccountId());
+			statement3.execute();
+			
+			PreparedStatement statement4 = connection.prepareStatement("UPDATE ACCOUNTS SET BALANCE = ? WHERE ACCOUNT_ID = ?");
+			statement4.setDouble(1, creditAccount.getBalance()+creditAmount);
+			statement4.setLong(2, creditAccount.getAccountId());
+			statement4.execute();
 			
 			return null;
 			
@@ -371,54 +395,62 @@ public static Transaction[] getTransactions(String startDate, String endDate, Ac
 		
 		if (accounts == null || accounts.length == 0)
 			return null;
-
-			Connection connection = getConnection();
-
-			
-			Statement statement = connection.createStatement();
-			
-			if (rowCount > 0)
-				statement.setMaxRows(rowCount);
-
-			StringBuffer acctIds = new StringBuffer();
-			acctIds.append("ACCOUNTID = " + accounts[0].getAccountId());
-			for (int i=1; i<accounts.length; i++){
-				acctIds.append(" OR ACCOUNTID = "+accounts[i].getAccountId());	
-			}
-			
-			String dateString = null;
-			
-			if (startDate != null && startDate.length()>0 && endDate != null && endDate.length()>0){
-				dateString = "DATE BETWEEN '" + startDate + " 00:00:00' AND '" + endDate + " 23:59:59'";
-			} else if (startDate != null && startDate.length()>0){
-				dateString = "DATE > '" + startDate +" 00:00:00'";
-			} else if (endDate != null && endDate.length()>0){
-				dateString = "DATE < '" + endDate + " 23:59:59'";
-			}
-			
-			String query = "SELECT * FROM TRANSACTIONS WHERE (" + acctIds.toString() + ") " + ((dateString==null)?"": "AND (" + dateString + ") ") + "ORDER BY DATE DESC" ;
-			ResultSet resultSet = null;
-			
-			try {
-				resultSet = statement.executeQuery(query);
-			} catch (SQLException e){
-				int errorCode = e.getErrorCode();
-				if (errorCode == 30000)
-					throw new SQLException("Date-time query must be in the format of yyyy-mm-dd HH:mm:ss", e);
-				
-				throw e;
-			}
-			ArrayList<Transaction> transactions = new ArrayList<Transaction>();
-			while (resultSet.next()){
-				int transId = resultSet.getInt("TRANSACTION_ID");
-				long actId = resultSet.getLong("ACCOUNTID");
-				Timestamp date = resultSet.getTimestamp("DATE");
-				String desc = resultSet.getString("TYPE");
-				double amount = resultSet.getDouble("AMOUNT");
-				transactions.add(new Transaction(transId, actId, date, desc, amount));
-			}
+	
+		Connection connection = getConnection();
+		
+		PreparedStatement statement = connection.prepareStatement("");
+		
+		if (rowCount > 0)
+			statement.setMaxRows(rowCount);
+	
+		StringBuffer acctIds = new StringBuffer();
+		acctIds.append("ACCOUNTID = ?");
+		for (int i=1; i<accounts.length; i++){
+			acctIds.append(" OR ACCOUNTID = ?");	
+		}
+		
+		statement.setString(i+1, String.valueOf(accounts[0].getAccountId()));
+		for (int j=1; j<accounts.length; j++){
+			statement.setString(j+1, String.valueOf(accounts[j].getAccountId()));	
+		}
+		
+		String dateString = null;
+		
+		if (startDate != null && startDate.length()>0 && endDate != null && endDate.length()>0){
+			dateString = "DATE BETWEEN ? AND ?";
+			statement.setString(i+accounts.length+1, startDate + " 00:00:00");
+			statement.setString(i+accounts.length+2, endDate + " 23:59:59");
+		} else if (startDate != null && startDate.length()>0){
+			dateString = "DATE > ?";
+			statement.setString(i+accounts.length+1, startDate +" 00:00:00");
+		} else if (endDate != null && endDate.length()>0){
+			dateString = "DATE < ?";
+			statement.setString(i+accounts.length+1, endDate + " 23:59:59");
+		}
+		
+		String query = "SELECT * FROM TRANSACTIONS WHERE (" + acctIds.toString() + ") " + ((dateString==null)?"": "AND (" + dateString + ") ") + "ORDER BY DATE DESC" ;
+		ResultSet resultSet = null;
+		
+		try {
+			resultSet = statement.executeQuery();
+		} catch (SQLException e){
+			int errorCode = e.getErrorCode();
+			if (errorCode == 30000)
+				throw new SQLException("Date-time query must be in the format of yyyy-mm-dd HH:mm:ss", e);
 			
-			return transactions.toArray(new Transaction[transactions.size()]); 
+			throw e;
+		}
+		ArrayList<Transaction> transactions = new ArrayList<Transaction>();
+		while (resultSet.next()){
+			int transId = resultSet.getInt("TRANSACTION_ID");
+			long actId = resultSet.getLong("ACCOUNTID");
+			Timestamp date = resultSet.getTimestamp("DATE");
+			String desc = resultSet.getString("TYPE");
+			double amount = resultSet.getDouble("AMOUNT");
+			transactions.add(new Transaction(transId, actId, date, desc, amount));
+		}
+		
+		return transactions.toArray(new Transaction[transactions.size()]); 
 	}
 
 	public static String[] getBankUsernames() {
@@ -446,64 +478,77 @@ public static String[] getBankUsernames() {
 	
 	public static Account getAccount(long accountNo) throws SQLException {
 
-		Connection connection = getConnection();
-		Statement statement = connection.createStatement();
-		ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE ACCOUNT_ID = "+ accountNo +" "); /* BAD - user input should always be sanitized */
-
-		ArrayList<Account> accounts = new ArrayList<Account>(3);
-		while (resultSet.next()){
-			String name = resultSet.getString("ACCOUNT_NAME");
-			double balance = resultSet.getDouble("BALANCE"); 
-			Account newAccount = new Account(accountNo, name, balance);
-			accounts.add(newAccount);
-		}
-		
-		if (accounts.size()==0)
-			return null;
-		
-		return accounts.get(0);
+	Connection connection = getConnection();
+	PreparedStatement statement = connection.prepareStatement("SELECT ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE ACCOUNT_ID = ?");
+	statement.setLong(1, accountNo);
+	ResultSet resultSet = statement.executeQuery();
+
+	ArrayList<Account> accounts = new ArrayList<Account>(3);
+	while (resultSet.next()){
+		String name = resultSet.getString("ACCOUNT_NAME");
+		double balance = resultSet.getDouble("BALANCE"); 
+		Account newAccount = new Account(accountNo, name, balance);
+		accounts.add(newAccount);
 	}
+	
+	if (accounts.size()==0)
+		return null;
+	
+	return accounts.get(0);
+}
 
 	public static String addAccount(String username, String acctType) {
 		try {
 			Connection connection = getConnection();
-			Statement statement = connection.createStatement();
-			statement.execute("INSERT INTO ACCOUNTS (USERID,ACCOUNT_NAME,BALANCE) VALUES ('"+username+"','"+acctType+"', 0)");
+			PreparedStatement statement = connection.prepareStatement("INSERT INTO ACCOUNTS (USERID,ACCOUNT_NAME,BALANCE) VALUES (?, ?, 0)");
+			statement.setString(1, username);
+			statement.setString(2, acctType);
+			statement.execute();
 			return null;
-		} catch (SQLException e){
+		} catch (SQLException e) {
 			return e.toString();
 		}
 	}
 	
 	public static String addSpecialUser(String username, String password, String firstname, String lastname) {
-		try {
-			Connection connection = getConnection();
-			Statement statement = connection.createStatement();
-			statement.execute("INSERT INTO SPECIAL_CUSTOMERS (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
-			return null;
-		} catch (SQLException e){
-			return e.toString();
-			
-		}
+	    try {
+	        Connection connection = getConnection();
+	        PreparedStatement statement = connection.prepareStatement("INSERT INTO SPECIAL_CUSTOMERS (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES (?,?,?,?,?)");
+	        statement.setString(1, username);
+	        statement.setString(2, password);
+	        statement.setString(3, firstname);
+	        statement.setString(4, lastname);
+	        statement.setString(5, "user");
+	        statement.execute();
+	        return null;
+	    } catch (SQLException e){
+	        return e.toString();
+	    }
 	}
 	
 	public static String addUser(String username, String password, String firstname, String lastname) {
 		try {
 			Connection connection = getConnection();
-			Statement statement = connection.createStatement();
-			statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
+			PreparedStatement statement = connection.prepareStatement("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES (?,?,?,?,?)");
+			statement.setString(1, username);
+			statement.setString(2, password);
+			statement.setString(3, firstname);
+			statement.setString(4, lastname);
+			statement.setString(5, "user");
+			statement.executeUpdate();
 			return null;
 		} catch (SQLException e){
 			return e.toString();
-			
 		}
 	}
 	
 	public static String changePassword(String username, String password) {
 		try {
 			Connection connection = getConnection();
-			Statement statement = connection.createStatement();
-			statement.execute("UPDATE PEOPLE SET PASSWORD = '"+ password +"' WHERE USER_ID = '"+username+"'");
+			PreparedStatement statement = connection.prepareStatement("UPDATE PEOPLE SET PASSWORD = ? WHERE USER_ID = ?");
+			statement.setString(1, password);
+			statement.setString(2, username);
+			statement.execute();
 			return null;
 		} catch (SQLException e){
 			return e.toString();
@@ -515,9 +560,13 @@ public static String changePassword(String username, String password) {
 	public static long storeFeedback(String name, String email, String subject, String comments) {
 		try{ 
 			Connection connection = getConnection();
-			Statement statement = connection.createStatement();
-			statement.execute("INSERT INTO FEEDBACK (NAME,EMAIL,SUBJECT,COMMENTS) VALUES ('"+name+"', '"+email+"', '"+subject+"', '"+comments+"')", Statement.RETURN_GENERATED_KEYS);
-			ResultSet rs= statement.getGeneratedKeys();
+			PreparedStatement statement = connection.prepareStatement("INSERT INTO FEEDBACK (NAME,EMAIL,SUBJECT,COMMENTS) VALUES (?,?,?,?)", Statement.RETURN_GENERATED_KEYS);
+			statement.setString(1, name);
+			statement.setString(2, email);
+			statement.setString(3, subject);
+			statement.setString(4, comments);
+			statement.execute();
+			ResultSet rs = statement.getGeneratedKeys();
 			long id = -1;
 			if (rs.next()){
 				id = rs.getLong(1);
diff --git a/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java b/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
index 5629335..67985e2 100644
--- a/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
+++ b/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
@@ -145,7 +145,8 @@ public static User getUser(HttpServletRequest request) throws SQLException{
 	
 	public static String makeRandomString() {
 	    byte[] array = new byte[7]; // length is bounded by 7
-	    new Random().nextBytes(array);
+	    SecureRandom random = new SecureRandom();
+	    random.nextBytes(array);
 	    String generatedString = new String(array, Charset.forName("UTF-8"));
 	 
 	    return generatedString;
diff --git a/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java b/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
index 6524e35..2939300 100644
--- a/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
+++ b/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
@@ -343,6 +343,7 @@ public static Cookie establishSession(String username, HttpSession session){
 			Account[] accounts = user.getAccounts();
 		    String accountStringList = Account.toBase64List(accounts);
 		    Cookie accountCookie = new Cookie(ServletUtil.ALTORO_COOKIE, accountStringList);
+			accountCookie.setSecure(true); 
 			session.setAttribute(ServletUtil.SESSION_ATTR_USER, user);
 		    return accountCookie;
 		}