Kuidas saab vältida JDBC kaudu parameetritega seotud SQL-koodi süstimisega seotud haavatavusi?

To prevent vulnerabilities related to SQL injection via parameters in JDBC, the following methods are used:

• PreparedStatement — use of parameterized queries, where parameters are passed separately and not directly inserted into the SQL string. This prevents interpretation of parameters as code.

• Validation and escaping of input data — checking and sanitizing data before using it in queries.

• Use of ORM — for example, Hibernate, which automatically generates safe queries.

Example of using PreparedStatement:

String sql = "SELECT * FROM users WHERE username = ? AND password = ?";
PreparedStatement pstmt = connection.prepareStatement(sql);
pstmt.setString(1, username);
pstmt.setString(2, password);
ResultSet rs = pstmt.executeQuery();

This approach prevents the possibility of injecting malicious SQL code through parameters.