After what seemed to be a so called secure connection to my database and login system, written by a so called 3rd party, I found out that I can indelibly hack into the system when I use SQL injection. Huh? What’s this? You see, all I need to know at times is your username and I can find ways to login.

But that’s just logging in, what about dropping your table. Here’s an example of why

public List processUser(String username, String password)
   throws SQLException
{
   String query = "SELECT * FROM userTbl WHERE id = '" + username + 
"' and pass= '" + password + "'";
   ResultSet rs = this.connection.executeQuery(query);
   // ... process results ...
}

The above seems very innocently innocent. Now imagining a login page. The user enters something weird. For example in password field he/she does this.

abc’ or a = ‘a

Now how would it look like.

String query = "SELECT * FROM userTbl WHERE id = '" + username +
"' and pass= '" + abc' or a = 'a + "'";

Now can you finally see the dangerousness of using Statement. The difference in using PreparedStatement I can now control what the user enters. To see some of my previous SQL queries using PreparedStatement refer this previous post about SQL.

So always be aware of the security of your codes. Hope this bring some enlightenment to the programmers out there.

String[] special = {"a1","a2","a3","a4"};  

Connection con = null;  

PreparedStatement stmt = null;  

PreparedStatement stmt2 = null;  

ResultSet rs = null;  

ResultSet rs2 = null;  

Class.forName ("com.mysql.jdbc.Driver")  

conn = DriverManager.getConnection (url, userName, password);  

String SQL_QUERY = " SELECT count(*) FROM tblABC WHERE " +
" name_tennis LIKE = ? ";  

String SQL_QUERY2 = " SELECT count(*) FROM tblABC WHERE " +
" name_swimwear LIKE = ? ";  

stmt = con.prepareStatement(SQL_QUERY);  

stmt2 = con.prepareStatement(SQL_QUERY2);  

for (int i=0;i<special[i].length;i++) {  

      stmt.setString(1,special[i]);  

      rs = stmt.executeQuery();  

      if (rs.next()) {  

         /* More work here */  

      }  

}  

for (int i=0;ii<special[i].length;i++) {  

stmt2.setString(1,special[i]);  

      rs2 = stmt2.executeQuery();  

      if (rs2.next()) {  

         /* More work here */  

      }  

}

The above is a very bad example of coding. It might work, and run smoothly but it’s really bad coding. What one should do is to not to let the code be redundant. For example, put both statements into one the loop.

for (int i=0;i<special[i].length;i++) {  

      stmt.setString(1,special[i]);  

      rs = stmt.executeQuery();  

      if (rs.next()) {  

         /* More work here */  

      }      stmt2.setString(1,special[i]);  

      rs2 = stmt2.executeQuery();  

      if (rs2.next()) {  

         /* More work here */  

      }  

}

What’s the use of this? Well, iif you have an object or rather a Bean to set into, you don’t have to loop and reloop. All can be done in the same loop. Well, hope this brings about some bad habits of coding java.