For one I'll keep the query as a final static
string of the class. Its more from the maintenance/readability and style benefit rather than performance.
As for the ArrayList its better to have it as a local variable inside the method. One reason is if the Object is involved in multi-threaded invocations it would be
thread safe. Having the ArrarList as a member variable gives no benefit.
Also in simple O-O terms, parametes does not seem to be a 'property' of UserDaoImpl.