Raw SQL Injection Risk (ARCH4055)

Key java.orm.raw-sql-injection-risk · Severity critical · Category orm

Building raw SQL via string interpolation opens SQL injection and busts the query plan cache. Pass values as bound parameters instead.

Incorrect

String sql = "SELECT * FROM users WHERE email = '" + email + "'";
Query q = entityManager.createNativeQuery(sql, User.class);
List<User> users = q.getResultList();

Correct

Query q = entityManager.createNativeQuery(
        "SELECT * FROM users WHERE email = :email", User.class);
q.setParameter("email", email);
List<User> users = q.getResultList();

Fix

Never concatenate user values into raw SQL; always use bound parameters.