SQL injection (ARCH4100)

Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.

Key java.security.sql-injection · Severity error · Category security · CWE CWE-89

Building a SQL query by concatenating user input lets attackers alter the query structure to read or modify data or bypass authentication.

Incorrect

String sql = "SELECT * FROM users WHERE name = '" + name + "'";
Statement st = conn.createStatement();
ResultSet rs = st.executeQuery(sql);

PreparedStatement ps =
    conn.prepareStatement("SELECT * FROM users WHERE name = ?");
ps.setString(1, name);
ResultSet rs = ps.executeQuery();

Use a PreparedStatement with bound parameters for all user input; never build SQL through string concatenation.