code: protected PreparedStatement executeSql(String sql,
      MapSqlParameterSource args)
    {
      // XXX: uses raw type, what are the parameters to Map in MapSqlParameterSource?
      Map<String, Object> parameters = args != null ? args.getValues()
        : new HashMap<String, Object>();
  
      for (Map.Entry<String, Object> placeHolderEntry : parameters.entrySet())
      {
        String key = placeHolderEntry.getKey();
        String value = placeHolderEntry.getValue().toString();
        log.debug("substitution for parameter '" + key + "' in SQL script: "
          + value);
        sql = sql.replaceAll(key, Matcher.quoteReplacement(value));
      }
      
      log.debug("Executing SQL\n{}", sql);
      
      CancelableStatements cancelableStats
        = new CancelableStatements(
          sql, statementController);
  
      // register the statement, so we could try to interrupt it in the gui.
      if (statementController != null)
      {
        statementController.registerStatement(cancelableStats.statement);
      }
      else
      {
        log.debug("statement controller is not initialized");
      }
      getJdbcTemplate().execute(cancelableStats, cancelableStats);
      return cancelableStats.statement;
  
    }
docs: executes an SQL string, substituting the
  parameters found in args
  
  @param sql
  @param args
  @return