SQL 인젝션 in Java

심각 CWE-89 Draft — pending review

Language: English Português (Brasil) Español Français Deutsch Русский 简体中文日本語 हिन्दी 한국어 Bahasa Indonesia

쉬운 설명 (ELI5)

티켓 번호만 입력해야 하는 창구에 데이터베이스를 조작하는 명령어를 입력하여 전체 회원 정보를 빼내는 공격입니다.

output encoding: Converting special markup characters into safe entities so browsers display them as text rather than script.

발생 원인

SQL 인젝션 in Java occurs when unvalidated strings are concatenated into JDBC Statement or HQL/JPQL queries.

실제 피해 사례

In 2005, the Samy XSS worm infected over 1 million user profiles on MySpace in under 20 hours, forcing the platform offline.

Documented historical AppSec case study.

취약한 코드 vs 수정된 코드

VULNERABLE

// userId comes straight from the request
String query = "SELECT * FROM users "
    + "WHERE id = " + userId;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

FIXED

// value is bound, never concatenated
String query = "SELECT * FROM users WHERE id = ?";
PreparedStatement stmt =
    connection.prepareStatement(query);
stmt.setString(1, userId);
ResultSet rs = stmt.executeQuery();

수정 방법이 동작하는 이유

PreparedStatement precompiles the query structure in the database engine, binding parameter values separately.

언어별 주요 주의사항

MyBatis: ${} vs #{}

#{} uses safe parameterized binding, while ${} performs raw string substitution.

Hibernate HQL/JPQL

Concatenating HQL queries is just as dangerous as raw SQL. Always use setParameter().

흔한 오해

"Stored procedures prevent injection"

Only if the stored procedure itself uses parameters rather than dynamic EXECUTE strings.

취약점 확인 방법

grep -rn "createStatement().*executeQuery(.*+" --include="*.java" .

Run SpotBugs with the FindSecBugs plugin in CI to catch SQL_INJECTION_JDBC automatically.

예방 체크리스트

✓Always use PreparedStatement with positional (?) or named parameters
✓Audit MyBatis ${} and Hibernate createQuery concatenation in CI

자주 묻는 질문 (FAQ)

Is Spring Data JPA safe?

Derived queries (@Query) are safe if method parameters are bound with :param or ?1.

참고 자료

언어 선택: Java Python JavaScript Java Go PHP C# Rust

참고할 취약점: Cross-Site Scripting Command InjectionPath Traversal