diff --git a/README.md b/README.md
index a70d1500..30fedcb3 100644
--- a/README.md
+++ b/README.md
@@ -189,6 +189,7 @@ Statement statement = TracingStatement.decorateStatement(statement);
 PreparedStatement preparedStatement = TracingStatement.decoratePreparedStatement(preparedStatement, sql);
 CallableStatement callableStatement = TracingStatement.decorateCallableStatement(callableStatement, sql);
 ```
+For security reasons, the SQL query is not recorded by default. However, you can opt-in to SQL query recording by setting the `AWS_XRAY_COLLECT_SQL_QUERIES` environment variable or the `com.amazonaws.xray.collectSqlQueries` system property to `true`.
 
 ### Intercept custom methods
 
diff --git a/aws-xray-recorder-sdk-sql/src/main/java/com/amazonaws/xray/sql/TracingStatement.java b/aws-xray-recorder-sdk-sql/src/main/java/com/amazonaws/xray/sql/TracingStatement.java
index 3839c738..d2ff9ded 100644
--- a/aws-xray-recorder-sdk-sql/src/main/java/com/amazonaws/xray/sql/TracingStatement.java
+++ b/aws-xray-recorder-sdk-sql/src/main/java/com/amazonaws/xray/sql/TracingStatement.java
@@ -37,6 +37,11 @@ public class TracingStatement {
 
     private static final Log logger = LogFactory.getLog(TracingStatement.class);
 
+    private static final boolean COLLECT_SQL_ENV =
+            Boolean.parseBoolean(System.getenv("AWS_XRAY_COLLECT_SQL_QUERIES"));
+    private static final boolean COLLECT_SQL_PROP =
+            Boolean.parseBoolean(System.getProperty("com.amazonaws.xray.collectSqlQueries"));
+
     /**
      * Call {@code statement = TracingStatement.decorateStatement(statement)} to decorate your {@link Statement}
      * in order to have the queries recorded with an X-Ray Subsegment. Do not use the method on {@link PreparedStatement}
@@ -87,8 +92,6 @@ private static class TracingStatementHandler implements InvocationHandler {
 
         private final Statement delegate;
 
-        // TODO: https://github.com/aws/aws-xray-sdk-java/issues/28
-        @SuppressWarnings("UnusedVariable")
         private final String sql;
 
         TracingStatementHandler(Statement statement, String sql) {
@@ -106,7 +109,7 @@ public Object invoke(Object proxy, Method method, Object[] args) throws Throwabl
             }
 
             logger.debug(
-                String.format("Invoking statement execution with X-Ray tracing. Tracing active: %s", subsegment != null));
+                    String.format("Invoking statement execution with X-Ray tracing. Tracing active: %s", subsegment != null));
             try {
                 // execute the query "wrapped" in a XRay Subsegment
                 return method.invoke(delegate, args);
@@ -143,11 +146,15 @@ private boolean isExecution(Method method) {
 
         private Subsegment createSubsegment() {
             try {
-                return SqlSubsegments.forQuery(delegate.getConnection(), null);
+                return SqlSubsegments.forQuery(delegate.getConnection(), collectSqlQueries() ? sql : null);
             } catch (SQLException exception) {
                 logger.warn("Failed to create X-Ray subsegment for the statement execution.", exception);
                 return null;
             }
         }
+
+        private boolean collectSqlQueries() {
+            return COLLECT_SQL_ENV || COLLECT_SQL_PROP;
+        }
     }
 }