Update SQLInjectionExample.java

[antonychiu2]

No description provided.

[github-actions]

SQL Injection fix is ready

This change fixes a critical severity (🚨) SQL Injection issue reported by Checkmarx.

Issue description

SQL Injection allows attackers to execute malicious SQL queries by manipulating input data. This can result in unauthorized access to sensitive data, data manipulation, or even complete database compromise.

Fix instructions

Use parameterized queries or prepared statements to sanitize user input and prevent manipulation of the SQL query.

diff --git a/src/main/java/SQLInjectionExample.java b/src/main/java/SQLInjectionExample.java
--- a/src/main/java/SQLInjectionExample.java
+++ b/src/main/java/SQLInjectionExample.java
@@ -1,3 +1,4 @@
+import java.sql.PreparedStatement;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
@@ -12,10 +13,11 @@
         try {
             Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/db");
 
-            String query = "SELECT * FROM users WHERE user name = '" + request.getParameter("username") + "';"; 
-            Statement stmt = con.createStatement(); 
+            String query = "SELECT * FROM users WHERE user name = ?;"; 
+            PreparedStatement stmt = con.prepareStatement(query); 
 
-            stmt.executeQuery(query);
+            stmt.setString(1, request.getParameter("username"));
+            stmt.executeQuery();
         } catch (Exception e) {
             throw new ServletException(e);
         }
 

Learn more and fine tune the fix