Update SQLInjectionExample.java

[antonychiu2]

No description provided.

[github-actions]

SQL Injection fix is ready

Apply the following code change to fix SQL Injection issue detected by Snyk:

diff --git a/src/main/java/SQLInjectionExample.java b/src/main/java/SQLInjectionExample.java
--- a/src/main/java/SQLInjectionExample.java
+++ b/src/main/java/SQLInjectionExample.java
@@ -1,3 +1,4 @@
+import java.sql.PreparedStatement;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
@@ -11,10 +12,11 @@
         try {
             Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/db");
 
-            String query = "SELECT * FROM users WHERE username = '" + request.getParameter("username") + "';";  
-            Statement stmt = con.createStatement(); 
+            String query = "SELECT * FROM users WHERE username = ?;";  
+            PreparedStatement stmt = con.prepareStatement(query); 
 
-            stmt.executeQuery(query);
+            stmt.setString(1, request.getParameter("username"));
+            stmt.executeQuery();
         } catch (Exception e) {
             throw new ServletException(e);
         }
 

Learn more and fine tune the fix

[github-actions]

1 fix is ready to be committed

SQL Injection - 1