From eb90dad888cb9f91e68b0c9cdf5c9624aa24239c Mon Sep 17 00:00:00 2001 From: Mobb autofixer Date: Tue, 13 Aug 2024 20:45:00 +0000 Subject: [PATCH] mobb fix commit: a4d49581-45c9-4061-99e7-fd0bdfc4f3c6 --- .../sqlinjection/introduction/SqlInjectionLesson8.java | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson8.java b/src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson8.java index ae7fbb9f44..34c60c3829 100644 --- a/src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson8.java +++ b/src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson8.java @@ -151,11 +151,12 @@ public static void log(Connection connection, String action) { String time = sdf.format(cal.getTime()); String logQuery = - "INSERT INTO access_log (time, action) VALUES ('" + time + "', '" + action + "')"; + "INSERT INTO access_log (time, action) VALUES ('" + time + "', ?)"; try { - Statement statement = connection.createStatement(TYPE_SCROLL_SENSITIVE, CONCUR_UPDATABLE); - statement.executeUpdate(logQuery); + PreparedStatement statement = connection.prepareStatement(logQuery, TYPE_SCROLL_SENSITIVE, CONCUR_UPDATABLE); + statement.setString(1, action); + statement.executeUpdate(); } catch (SQLException e) { System.err.println(e.getMessage()); }