JAVA - Possible SQL Injection

Question

So I have this snippet of code:

String username = props.getProperty("jdbc.username");
try {
                String username = parts[1];

                // Check procedure
                System.out.println("Checking user");

                // Check database user table for username
                conn = getSQLConnection();
                Statement stat = conn.createStatement();
                ResultSet user = stat.executeQuery( "SELECT * FROM USER WHERE log_id='" + username + "';" );
                // Check given password against user entry
                if(user.next()){
                    System.out.println("User Exists: " + username);
                    sendMessage("true");
                    return;
                }
                else{

                    System.out.println("User Does Not Exist: " + username);
                    sendMessage("false user");
                    return;
                }

For educational purposes, is the SQL statement protected from an SQL injection even though I know where the input is coming from?

you always have 100% control of what username could be into your system ? — Jigar Joshi
– Jigar Joshi, Commented Apr 20, 2015 at 21:43
No, it is not protected. As long as you use a concatenated string to create the query, you're not protected. — Luiggi Mendoza
– Luiggi Mendoza, Commented Apr 20, 2015 at 21:45
Just that I understand to ONLY ever use prepared statements. But in this case where I'm not am I still open to SQL injection through the username even though a user is not specifying the username — Andrew Ricci
– Andrew Ricci, Commented Apr 20, 2015 at 22:10

fge · Accepted Answer · 2015-04-20 21:56:01Z

6

ResultSet user = stat.executeQuery( "SELECT * FROM USER WHERE log_id='" + username + "';" );

This is subject to SQL injection.

Imagine what happens if username has this value:

John'; delete from user where 'a' = 'a

And yes, a s*load of Java JDBC SQL tutorials get this wrong. Basically, always use PreparedStatements.

Not only because this makes it safe ot use even if username has malicious values as the above, but also, and more importantly, because the same query can be reused by the RDBMS engine for all further invocations.

In short, there is no reason at all not to use them. And tutorials demonstrating SQL using string concatenation should die a painful, SQL injection death.

edited Apr 20, 2015 at 21:56

answered Apr 20, 2015 at 21:45

fge

122k35 gold badges266 silver badges340 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Andrew Ricci Over a year ago

Thank you for your answer/comment. You explained alot for me :)

Andrew Ricci Over a year ago

Is the jdbc.username able to be easily changed for an SQL injection to happen.

Vlad Mihalcea · Accepted Answer · 2018-01-06 10:39:04Z

0

As explained in this post, one rogue attacker can do the following to yoour application:

call a sleep function so that all your database connections will be busy, therefore making your application unavailable
extracting sensitive data from the DB
bypassing the user authentication

And it's not just SQL that can be affected. Even JPQL can be compromised if you are not using bind parameters.

Bottom line, you should never use string concatenation when building SQL statements. Use a dedicated API for that purpose:

edited Jan 6, 2018 at 10:39

answered Nov 8, 2016 at 15:02

Vlad Mihalcea

156k85 gold badges598 silver badges984 bronze badges

Collectives™ on Stack Overflow

JAVA - Possible SQL Injection

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related