Using JOOQ, what more do I need to prevent sql injections

Question

How is this a duplicate as i am specifically asking about JOOQ here?

I am using JOOQ in my JAVA project to handle all my PostgreSQL queries. I read in this article that JOOQ uses prepared statements to execute all queries.

1. Is it than safe to assume that I don't need to worry about SQL injection or user input when executing my queries?

2. I don't need to worry about escaping the user input before giving it over to JOOQ?

3. On the side note, which other vulnerabilities are there to my DB in getting user input (apart from those that are solved by prepared statements), that I should be careful of?

Answer 1

1) Yes, as long as you use the provided API's correctly. It is still possible to inject plain sql queries though so be careful.

All methods in the jOOQ API that allow for plain (unescaped, untreated) SQL contain a warning message in their relevant Javadoc

// This query will use bind values, internally.
create.fetch("SELECT * FROM BOOK WHERE ID = ? AND TITLE = ?", 5, "Animal Farm");
// This query will not use bind values, internally.
create.fetch("SELECT * FROM BOOK WHERE ID = 5 AND TITLE = 'Animal Farm'");

See JOOQ docs here for a more in depth explanation: https://www.jooq.org/doc/3.9/manual/sql-building/bind-values/sql-injection/

2) No, see above.

3) Aside from that just beware of general DB security issues, such as user authentication/roles and storing sensitive data in an unecrypted format etc