flawopen.com/Injeção de SQL/Java
Imagine um guichê que só espera um número de protocolo. A injeção de SQL acontece quando alguém digita uma frase mágica que faz o sistema revelar todos os protocolos salvos.
Injeção de SQL in Java occurs when unvalidated strings are concatenated into JDBC Statement or HQL/JPQL queries.
In 2005, the Samy XSS worm infected over 1 million user profiles on MySpace in under 20 hours, forcing the platform offline.
Documented historical AppSec case study.// userId comes straight from the request
String query = "SELECT * FROM users "
+ "WHERE id = " + userId;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);
// value is bound, never concatenated
String query = "SELECT * FROM users WHERE id = ?";
PreparedStatement stmt =
connection.prepareStatement(query);
stmt.setString(1, userId);
ResultSet rs = stmt.executeQuery();
PreparedStatement precompiles the query structure in the database engine, binding parameter values separately.
#{} uses safe parameterized binding, while ${} performs raw string substitution.
Concatenating HQL queries is just as dangerous as raw SQL. Always use setParameter().
Only if the stored procedure itself uses parameters rather than dynamic EXECUTE strings.
grep -rn "createStatement().*executeQuery(.*+" --include="*.java" .
FindSecBugs plugin in CI to catch SQL_INJECTION_JDBC automatically.Derived queries (@Query) are safe if method parameters are bound with :param or ?1.