Search code examples
securitysql-injection

Java SQL injection code scanner?

I wanted to find out the SQL statements in my application which was not written using PreparedStatement which are vulnerable to SQL injection attack.

Any code scanner which can does this job?

Solution

  • These two tools do a number of security checks on Java code:

    http://suif.stanford.edu/~livshits/work/lapse/download.html

    http://jsecscanner.sourceforge.net/

    The first one definitely checks for vulnerability to SQL injection. Not sure about the second, but even if it doesn't it will do other useful checks. Both are plugins to the Eclipse IDE.