Java - Hacer un arraylist

<%

String cod_id = request.getParameter("cod_id").toString();

String  data ="";

Connection conn = null;

String url = "jdbc:mysql://10.140.0.154:3306/";

String dbName = "promociones";

String driver = "com.mysql.jdbc.Driver";

String userName = "desarrollo";

String password = "Programa2017";

int sumcount=0;

Statement st;

try {

	Class.forName(driver).newInstance();

	conn = DriverManager.getConnection(url+dbName,userName,password);

	String query = "select * from codigos where codigo='"+cod_id+"'";

	st = conn.createStatement();

	ResultSet  rs = st.executeQuery(query);

	while(rs.next())

	{

		data = ":" + cod_id + ":" + rs.getString(3) + ":" + rs.getString(4) + ":" + rs.getString(5);

	}

	out.println(data);

}

catch (Exception e) {

	e.printStackTrace();

}

%>

while(rs.next())

{

	data = ":" + cod_id + ":" + rs.getString(3) + ":" + rs.getString(4) + ":" + rs.getString(5);

	out.println(data);

}

ArrayList<String> lista=new ArraList<>();

.....

//Recorres el resulset

while(rs.next())

{

	data = ":" + cod_id + ":" + rs.getString(3) + ":" + rs.getString(4) + ":" + rs.getString(5);

	lista.add(data);

}

//Recorres la lista del arraylist con un for eche

for(String dato:lista){

    out.println(dato);

}

String query = "select * from codigos where codigo='"+cod_id+"'"; //Esto es el claro ejemplo de SQL Injection 

String query = "select * from codigos where codigo=?";

//Antes de ejecutar el executeQuery

st.setInt(1, cod_id);