如何使用 JPA 在本机插入查询中防止 SQL 注入？

Question

I'm using a native query with JPA / Hibernate to perform an insert or update ("upsert") on PostgreSQL, depending whether an object exists or not. The code looks like this:

val values: String = items.joinToString(", ", transform = this::convertItemToSqlValue)
val query = """
    insert into item (field1, field2)
    values $values
    on conflict on constraint item_pkey
    do update set 
        field1 = excluded.field1,
        field2 = excluded.field2
"""
entityManager.createNativeQuery(query).executeUpdate()

The function convertItemToSqlValue creates a String of the form ('value a', 123) .

A positional parameter ( values? ) didn't work (and led to a syntax error).

How could I prevent SQL injection with this kind of statmentement?

Answer 1

Building SQL statements from user input dynamically is not the best idea. It is better to use prepared statements. However there seems not be an easy way to perform patch updates with the JPA EntityManager in this case.

Setting multiple values is possible with JDBC. The following example show the usage with Spring's JdbcTemplate :

val items: List<Item> = ...

val statement = 
    """
    insert into item (field1, field2)
    values (?,?)
    on conflict on constraint arbeit_pkey
    do update set 
        field1 = excluded.field1,
        field2 = excluded.field2
    """
jdbcTemplate.batchUpdate(
    statement, 
    object : BatchPreparedStatementSetter {
        override fun setValues(statement: PreparedStatement, index: Int) {
            val item = items[index]
            statement.setString(1, item.field1)
            statement.setInt(2, item.field2)
        }
        override fun getBatchSize(): Int = items.size
    }
)