Search code examples
javajdbcprepared-statementsql-injection

Does the preparedStatement avoid SQL injection?

I have read and tried to inject vulnerable sql queries to my application. It is not safe enough. I am simply using the Statement Connection for database validations and other insertion operations.

Is the preparedStatements safe? and moreover will there be any problem with this statement too?

Solution

  • Using string concatenation for constructing your query from arbitrary input will not make PreparedStatement safe. Take a look at this example:

    preparedStatement = "SELECT * FROM users WHERE name = '" + userName + "';";

    If somebody puts

    ' or '1'='1

    as userName, your PreparedStatement will be vulnerable to SQL injection, since that query will be executed on database as

    SELECT * FROM users WHERE name = '' OR '1'='1';

    So, if you use

    preparedStatement = "SELECT * FROM users WHERE name = ?";
preparedStatement.setString(1, userName);

    you will be safe.

    Some of this code taken from this Wikipedia article.