如何防止我的网站进行sql Injection？ 支柱

Question

how to prevent my website from doing sql injection in it

I am working using Struts 2 , DB MY sql .

Answer 1

The best way I think is to not re-invent the wheel and use the tools already available. For a small project I would recommend to simply use prepared statements when querying your database.

http://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html

You could also look into using an ORM like Hybernate. But make sure to use it as intended. Even HQL can be susceptible to injection. See: how much safe from SQL-Injection if using hibernate

The important thing is to not write your own native queries by concatenating query strings with values from untrusted sources.