SQL injection (ARCH4100)

Key java.security.sql-injection · Severity error · Category security · CWE CWE-89

Building a SQL query by concatenating user input lets attackers alter the query structure to read or modify data or bypass authentication.

Incorrect

String sql = "SELECT * FROM users WHERE name = '" + name + "'";
Statement st = conn.createStatement();
ResultSet rs = st.executeQuery(sql);

Correct

PreparedStatement ps =
    conn.prepareStatement("SELECT * FROM users WHERE name = ?");
ps.setString(1, name);
ResultSet rs = ps.executeQuery();

Fix

Use a PreparedStatement with bound parameters for all user input; never build SQL through string concatenation.