flawopen.com/SQL-инъекция/Java
Представьте форму, ожидающую номер квитанции. Злоумышленник вводит команду, которая заставляет базу выдать вообще все записи, потому что система не проверила формат ввода.
SQL-инъекция in Java occurs when unvalidated strings are concatenated into JDBC Statement or HQL/JPQL queries.
In 2005, the Samy XSS worm infected over 1 million user profiles on MySpace in under 20 hours, forcing the platform offline.
Documented historical AppSec case study.// userId comes straight from the request
String query = "SELECT * FROM users "
+ "WHERE id = " + userId;
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);
// value is bound, never concatenated
String query = "SELECT * FROM users WHERE id = ?";
PreparedStatement stmt =
connection.prepareStatement(query);
stmt.setString(1, userId);
ResultSet rs = stmt.executeQuery();
PreparedStatement precompiles the query structure in the database engine, binding parameter values separately.
#{} uses safe parameterized binding, while ${} performs raw string substitution.
Concatenating HQL queries is just as dangerous as raw SQL. Always use setParameter().
Only if the stored procedure itself uses parameters rather than dynamic EXECUTE strings.
grep -rn "createStatement().*executeQuery(.*+" --include="*.java" .
FindSecBugs plugin in CI to catch SQL_INJECTION_JDBC automatically.Derived queries (@Query) are safe if method parameters are bound with :param or ?1.