Java（或任何其他语言）中的SQL注入指南

Question

I have a jsp code which has a query like

'select * from MyTable where

Column1='+request.getParameter('q'),

which is executed from a

java.sql.Statement. Now, provided we can append the query by using the

request parameter, my target is to change the query to something like:

Select * from MyTable where Column1 = a; Delete from MyTable;

since the original select query is executed through java.sql.Statement,

how can we do such sql injection ? If the question is not clear, kindly

comment, I'll try to provide further explanations.

Answer 1

SQL Injection Guide: Link1 & Link2 ,but there are so many relevant threads in Stackoverflow regarding SQL Injection like Q & A .

Do one thing,search by -> sql injection java stackoverflow

Answer 2

if we inject q as a anything' OR 'x'='x then it will select all the column which can be vulnerable. as because variables passed as arguments to prepared statements will automatically be escaped by the JDBC driver

Although Prepared Statements helps in defending against SQL Injection, there are possibilities of SQL Injection attacks through inappropriate usage of Prepared Statements. The example below explains such a scenario where the input variables are passed directly into the Prepared Statement and thereby paving way for SQL Injection attacks.

Answer 3

Check out this article , which explains how the Statement and PreparedStatement , as well as executeQuery() and executeUpdate() behave when it comes to SQL Injection.

Apart from the classic DROP tables, there are more scenarios to watch out, like:

• call a sleep function so that all your database connections will be busy, therefore making your application unavailable
• extracting sensitive data from the DB
• bypassing the user authentication

And it's not just SQL that can b affected. Even JPQL can be compromised if you are not using bind parameters.

Bottom line, you should never use string concatenation when building SQL statements. Use a dedicated API for that purpose:

• JPA Criteria API
• jOOQ