jQuery to get value from page and pass it to HTTPServletRequest for java to use

Question

I am working with an application which is built using html, Javascript and jQuery for the front end and uses Java and Oracle for back end and database.

Currently it passes data back from front end to java with a URL parameter appended to the end like http://localhost/28182391238912398172 &id=12345

It then uses an AJAX GET request to call on the servlet using the id from the URL to run a prepared statement to query the database using Java.

What I need to do is remove the appending of the parameter in the URL and pass it another way so it's not in the URL. Essentially I'm trying to prevent SQL Injection possibility but I'm not sure how to pass this value back and save it to the HTTPServletRequest so I can call it up from Java in the back end.

Would I have to do a another AJAX call but using POST to save it somehow?

Thank you for any thoughts on this!

Answer 1

About sql injection, you have to care about it on server side and try to write a safe code like this:

PreparedStatement stmt = connection.prepareStatement("SELECT * FROM table WHERE id=?");
stmt.setString(1, id);
ResultSet rs = stmt.executeQuery();