dubey/WebGoat
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

1101: fix quoting in statement

Browse Source
This commit is contained in:
Nanne Baars 2021-09-30 16:53:43 +02:00 committed by Nanne Baars
parent dfa0e1cdca
commit a7b9954d0f
1 changed files with 12 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
webgoat-lessons/sql-injection/src/main/resources/lessonPlans/en/SqlInjection_content7.adoc
View File

@ -1,23 +1,26 @@
== Immutable Queries == Immutable Queries
These are the best defense against SQL injection. They either do not have data that could get interpreted or they treat the data as a single entity that is bound to a column without interpretation. These are the best defense against SQL injection. They either do not have data that could get interpreted, or they treat the data as a single entity that is bound to a column without interpretation.
=== Static Queries === Static Queries
-------------------------------------------------------
SELECT * FROM products;
-------------------------------------------------------
------------------------------------------------------- ----
SELECT * FROM users WHERE user = "'" + session.getAttribute("UserID") + "'"; String query = "SELECT * FROM products";
------------------------------------------------------- ----
----
String query = "SELECT * FROM users WHERE user = '" + session.getAttribute("UserID") + "'";
----
=== Parameterized Queries === Parameterized Queries
-------------------------------------------------------
----
String query = "SELECT * FROM users WHERE last_name = ?"; String query = "SELECT * FROM users WHERE last_name = ?";
PreparedStatement statement = connection.prepareStatement(query); PreparedStatement statement = connection.prepareStatement(query);
statement.setString(1, accountName); statement.setString(1, accountName);
ResultSet results = statement.executeQuery(); ResultSet results = statement.executeQuery();
------------------------------------------------------- ----
=== Stored Procedures === Stored Procedures
Only if stored procedure does not generate dynamic SQL Only if stored procedure does not generate dynamic SQL