Update SQLInjectionExample.java

[antonychiu2]

No description provided.

[github-actions]

1 fix is ready to be committed

SQL Injection - 1

[github-actions]

SQL Injection fix is ready

This change fixes a high severity (🚩) SQL Injection issue reported by Snyk.

Issue description

SQL Injection allows attackers to execute malicious SQL queries by manipulating input data. This can result in unauthorized access to sensitive data, data manipulation, or even complete database compromise.

Fix instructions

Use parameterized queries or prepared statements to sanitize user input and prevent manipulation of the SQL query.

diff --git a/src/main/java/SQLInjectionExample.java b/src/main/java/SQLInjectionExample.java
--- a/src/main/java/SQLInjectionExample.java
+++ b/src/main/java/SQLInjectionExample.java
@@ -1,3 +1,4 @@
+import java.sql.PreparedStatement;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
@@ -11,10 +12,11 @@
         try {
             Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/db");
 
-            String query = "SELECT * FROM users WHERE username = '" + request.getParameter("username") + "';";  
-            Statement stmt = con.createStatement(); 
+            String query = "SELECT * FROM users WHERE username = ?;";  
+            PreparedStatement stmt = con.prepareStatement(query); 
 
-            stmt.executeQuery(query);
+            stmt.setString(1, request.getParameter("username"));
+            stmt.executeQuery();
         } catch (Exception e) {
             throw new ServletException(e);
         }
 

Learn more and fine tune the fix