class Login {
  public Connection getConnection() throws SQLException {
    DriverManager.registerDriver(new com.microsoft.jdbc.sqlserver.SQLServerDriver());
    String dbConnection = PropertyManager.getProperrty("db.connection");
    // can hold some value like "jdbc:microsoft:sqlserver://<HOST>:1433,<UID>,<PWD>"
    return DriverManager.getConnection(dbConnection);
  }

  String hashPassword(char[] password) {
    // create hash of password
  }

  public void doPrivilegedAction(String username, char[] password) throws SQLException {
    Connection connection = getConnection();
    if (connection == null) {
      // handle error
    }
    String pwd = hashPassword(password);

    String sqlString = "SELECT * FROM db_user WHERE username = '" + username +
                       "' AND password = '" + pwd + "'";
    Statement stmt = connection.createStatement();
    ResultSet rs = stmt.executeQuery(sqlString);

    if (!rs.next()) {
    	 throw new SecurityException("User name or password incorrect");
    }

    // Authenticated; proceed
  }
}

private void createXMLStream(BufferedOutputStream outStream, String quantity) {
  // Write XML string if quantity contains numbers only (whitelisting)
  // Blacklisting of invalid characters can also be done in conjunction

  if (!Pattern.matches("[0-9]+", quantity)) {
    // Format violation
  }

  String xmlString = "<item>\n<description>Widget</description>\n<price>500</price>\n" +
                     "<quantity>" + quantity + "</quantity></item>";
  outStream.write(xmlString.getBytes());
  outStream.flush();
}