flawopen.com/SQL-Injection/Java
Stell dir ein Formular vor, das nur eine Ticketnummer erwartet. SQL-Injection passiert, wenn jemand Code in dieses Feld eingibt, der die Datenbank dazu bringt, alle Daten herauszugeben, weil die Eingabe unbereinigt in den Befehl eingefügt wurde.
SQL-Injection in Java occurs when unvalidated strings are concatenated into JDBC Statement or HQL/JPQL queries.
In 2005, the Samy XSS worm infected over 1 million user profiles on MySpace in under 20 hours, forcing the platform offline.
Documented historical AppSec case study.// userId comes straight from the request
String query = "SELECT * FROM users "
+ "WHERE id = " + userId;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);
// value is bound, never concatenated
String query = "SELECT * FROM users WHERE id = ?";
PreparedStatement stmt =
connection.prepareStatement(query);
stmt.setString(1, userId);
ResultSet rs = stmt.executeQuery();
PreparedStatement precompiles the query structure in the database engine, binding parameter values separately.
#{} uses safe parameterized binding, while ${} performs raw string substitution.
Concatenating HQL queries is just as dangerous as raw SQL. Always use setParameter().
Only if the stored procedure itself uses parameters rather than dynamic EXECUTE strings.
grep -rn "createStatement().*executeQuery(.*+" --include="*.java" .
FindSecBugs plugin in CI to catch SQL_INJECTION_JDBC automatically.Derived queries (@Query) are safe if method parameters are bound with :param or ?1.