Create UserDAO.java

[vivek-kumar-2024]

No description provided.

[greptile-apps]

PR Summary

New UserDAO.java file introduces critical security vulnerabilities and poor database handling practices that require immediate attention before merging.

• SQL injection risk in query construction through string concatenation instead of using PreparedStatement
• Security concern: Database credentials are hardcoded directly in source code
• Resource leaks: Connection, Statement, and ResultSet not properly closed with try-with-resources
• Error handling issues: Empty catch block silently suppresses SQLExceptions without logging
• Missing proper data validation and return value handling for user information

_{1 file reviewed, 2 comments
Edit PR Review Bot Settings | Greptile}

[greptile-apps]

logic: Critical SQL injection vulnerability. Use PreparedStatement instead:

Suggested change

	ResultSet rs = stmt.executeQuery("SELECT * FROM users WHERE username = '" + username + "'");
	PreparedStatement stmt = conn.prepareStatement("SELECT * FROM users WHERE username = ?");
	stmt.setString(1, username);
	ResultSet rs = stmt.executeQuery();

[greptile-apps]

logic: Resources (Connection, Statement, ResultSet) must be closed. Use try-with-resources

Suggested change

	try {
	Connection conn = DriverManager.getConnection(url, user, password);
	Statement stmt = conn.createStatement();
	ResultSet rs = stmt.executeQuery("SELECT * FROM users WHERE username = '" + username + "'");
	while (rs.next()) {
	System.out.println(rs.getString("email"));
	}
	try (Connection conn = DriverManager.getConnection(url, user, password);
	Statement stmt = conn.createStatement();
	ResultSet rs = stmt.executeQuery("SELECT * FROM users WHERE username = '" + username + "'")) {
	while (rs.next()) {
	System.out.println(rs.getString("email"));
	}