diff --git a/src/ru/charm/back/dao/ProfileDao.java b/src/ru/charm/back/dao/ProfileDao.java
index c169cb1..1778071 100644
--- a/src/ru/charm/back/dao/ProfileDao.java
+++ b/src/ru/charm/back/dao/ProfileDao.java
@@ -30,12 +30,15 @@ public class ProfileDao {
     }
 
     public Profile save(Profile profile) {
+        String sql = "INSERT INTO profile(email, password) VALUES (?, ?)";
         try (
                 Connection connection = DriverManager.getConnection(URL, USER, PASSWORD);
-                Statement statement = connection.createStatement();
+                PreparedStatement statement = connection.prepareStatement(sql, Statement.RETURN_GENERATED_KEYS);
         ) {
-            String sql = "INSERT INTO profile(email, password) VALUES ('%s', '%s')".formatted(profile.getEmail(), profile.getPassword());
-            int insertCount = statement.executeUpdate(sql, Statement.RETURN_GENERATED_KEYS);
+
+            statement.setString(1, profile.getEmail());
+            statement.setString(2, profile.getPassword());
+            int insertCount = statement.executeUpdate();
             ResultSet res = statement.getGeneratedKeys();
 
             if (res.next()) {
@@ -54,7 +57,7 @@ public class ProfileDao {
                 Connection connection = DriverManager.getConnection(URL, USER, PASSWORD);
                 Statement statement = connection.createStatement();
         ) {
-            String sql = "SELECT * FROM profile WHERE id = %s".formatted(id);
+            String sql = "SELECT * FROM profile WHERE id = '%s'".formatted(id);
             ResultSet res = statement.executeQuery(sql);
 
             Profile profile = null;
@@ -192,12 +195,14 @@ public class ProfileDao {
     }
 
     public Optional<Profile> findByEmail(String email) {
+        String sql = "SELECT * FROM profile WHERE email = ?";
+
         try (
                 Connection connection = DriverManager.getConnection(URL, USER, PASSWORD);
-                Statement statement = connection.createStatement();
+                PreparedStatement statement = connection.prepareStatement(sql);
         ) {
-            String sql = "SELECT * FROM profile WHERE email = '%s'".formatted(email);
-            ResultSet res = statement.executeQuery(sql);
+            statement.setString(1, email);
+            ResultSet res = statement.executeQuery();
 
             Profile profile = null;
             if (res.next()) {