如何修改代码以避免 SQL 注入攻击？

Question

I need to implement a fuzzy search for two fields, businessName and businessAddress . Both of them can be null . If one field is null , search should be based on the other field.

To be specific,

• if businessName="name" and businessAddress="address" then execute select * from business where businessName like '%name%' and businessAddress like '%address%'
• if businessName=null and businessAddress="address" then execute select * from business where businessAddress like '%address%'
• if businessName=null and businessAddress=null then execute select * from business

My code:

StringBuilder sb = new StringBuilder("select * from business where 1=1 ");

if (businessName != null) {
    sb.append("and businessName like '%" + businessName + "%' ");
}
if (businessAddress != null) {
    sb.append("and businessAddress like '%" + businessAddress + "%' ");
}

try {
    con = DBUtil.getConnection();
    pst = con.prepareStatement(sb.toString());
    rs = pst.executeQuery();
} ...

Apparently it's in danger of SQL-injection attack. I know method prepareStatement.setString() can avoid attack, but number of fields is uncertain before verification.

How can I modify it? Separate method for each case or code like below seem ugly.

if(businessName!=null){
    if(businessAddress!=null){
        sql = ...;
    }else {
        sql = ...;
    }
else{
...

Answer 1

Never, ever, concatenate values into a query string like that. Always use prepared statements with parameters when executing queries, especially with user-sourced values.

A simple solution for your case is to use a list of values for each parameter you add, and then set the values collected for those parameters before execute:

StringBuilder sb = new StringBuilder("select * from business where 1=1 ");
List<String> parameters = new ArrayList<>();
if (businessName != null) {
    sb.append("and businessName like '%' || ? || '%' ");
    parameters.add(businessName);
}
if (businessAddress != null) {
    sb.append("and businessAddress like '%' || ? || '%' ");
    parameters.add(businessAddress)
}

try (Connection con = DBUtil.getConnection();
     PreparedStatement pst = con.prepareStatement(sb.toString())) {
    int index = 1;
    for (String parameter : parameters) {
        pst.setString(index++, parameter);
    }
    
    try (ResultSet rs = pst.executeQuery()) {
        // ...
    }
}

If you have parameters of varying types, use a List<Object> and setObject instead.

---

The solution in the answer by MT0 also works, but not all database systems optimize that type of query well (especially if you have a lot of such conditions), which might affect performance. For only a few conditions, the solution by MT0 is more readable, while having same/similar performance.

Answer 2

You do not need dynamic SQL and can use bind variables in the query:

String query = "select * from business where businessName LIKE '%' || ? || '%' AND businessAddress LIKE '%' || ? || '%'";

(Assuming || is the string concatenation operator for your SQL dialect.)

And then use a prepared statement and bind businessName and businessAddress to the variables.

PreparedStatement st = con.prepareStatement(query);
st.setString(1,businessName);
st.setString(2,businessAddress);
ResultSet rs = st.executeQuery();

(Add exception handling.)

---

Or, if your SQL dialect requires you to handle NULL separately from the LIKE then:

String query = "select * from business
                where (:name IS NULL OR businessName LIKE '%' || :name || '%')
                AND   (:addr IS NULL OR businessAddress LIKE '%' || :addr || '%')";

and use named bind variables :name and :addr (or use ? pass the values twice).

Answer 3

Except Mark Rotteveel' answer, I think there are 2 additional methods to solve your question.

1. Escape user's input string to avoid sql-injection. But this way is not 100% secure .You can use ESAPI to do this, please refer to SQL_Injection_Prevention_Cheat_Sheet .

2. You can use ORM framework,like MyBatis. For example, MyBatis have dynamic-sql ,it allows you generate different sql according to different conditions. In addition, use #{xxx} not ${xxx} to keep sql-injection away.