flawopen.com/SQL इंजेक्शन/Java
सोचिए एक टिकट काउंटर जहां केवल टिकट नंबर दर्ज करना है। यदि कोई चालाक कोड टाइप करके सिस्टम से सभी टिकट दिखाने को कह दे, तो यह SQL इंजेक्शन है।
SQL इंजेक्शन in Java occurs when unvalidated strings are concatenated into JDBC Statement or HQL/JPQL queries.
In 2005, the Samy XSS worm infected over 1 million user profiles on MySpace in under 20 hours, forcing the platform offline.
Documented historical AppSec case study.// userId comes straight from the request
String query = "SELECT * FROM users "
+ "WHERE id = " + userId;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);
// value is bound, never concatenated
String query = "SELECT * FROM users WHERE id = ?";
PreparedStatement stmt =
connection.prepareStatement(query);
stmt.setString(1, userId);
ResultSet rs = stmt.executeQuery();
PreparedStatement precompiles the query structure in the database engine, binding parameter values separately.
#{} uses safe parameterized binding, while ${} performs raw string substitution.
Concatenating HQL queries is just as dangerous as raw SQL. Always use setParameter().
Only if the stored procedure itself uses parameters rather than dynamic EXECUTE strings.
grep -rn "createStatement().*executeQuery(.*+" --include="*.java" .
FindSecBugs plugin in CI to catch SQL_INJECTION_JDBC automatically.Derived queries (@Query) are safe if method parameters are bound with :param or ?1.