A bad way of running a SQL query in JDBC

MGuess answered on October 1, 2021 Popularity 1/10 Helpfulness 1/10

answer A bad way of running a SQL query in JDBC

A bad way of running a SQL query in JDBC

Comment

// The user we want to find.
String email = "user@email.com";

// Connect to the database.
Connection conn = DriverManager.getConnection(URL, USER, PASS);
Statement stmt = conn.createStatement();

// Bad, bad news! Don't construct the query with string concatenation.
String sql = "SELECT * FROM users WHERE email = '" + email + "'";

// I have a bad feeling about this...
ResultSet results = stmt.executeQuery(sql);

while (results.next()) {
  // ...oh look, we got hacked.
}

Popularity 1/10 Helpfulness 1/10 Language sql

Source: www.hacksplaining.com

Tags: jdbc sql

Link to this answer
Share Copy Link