There aren't any rules which say you always have to put the
JDBC code in a particular part of your code. That's not how programming works. It's up to you to write the program and put the code in the correct places. (Where "correct" means "whatever works for your requirements".)
And likewise, no, you aren't required to use an ArrayList or any other collection in any code you write.
If you have a specific question,
you should ask that specific question here. It seems like you don't know where to go with this SAX program you want to write. So how about if you produce some code, then explain your requirements and ask what to do with that code?