Do not return sensitive error code and message to the end-user.Limit the application’s access to the database via permissions & grants.If you are using plain JDBC, then use PreparedStatement to execute the query. Use positional parameters in the query.Use frameworks like Hibernate and Spring Data JPA for the data layer of an application.Do not directly concatenate data ( received as user input) to create SQL queries.Email, firstname, lastname are common column names. For example, many applications use tbluser or tblaccount to store user data. Do not use common words as your table name or column name.Validate data before using them in the query.The underlying JDBC API takes care of sanitizing the values to avoid SQL injection.

We have set the first Parameter by using tString(1, username) and the second parameter by using tString(2, password). We use methods available in the PreparedStatement to provide user Input. We don’t concatenate username and password to query. There are 2 positional parameters in the above query. The question mark (?) in the above query is called a positional parameter. Query: select * from tbluser where username = ? and password = ? Let’s understand what’s happening in this case. Let’s have a look at the below example code. The value of userId is received from the user request. We have functionality in the application, which lets you get information via userId.

The userId is the primary column of the table. Suppose we have a database table named tbluser which stores data of application users.

A hacker can also get control of the system on which database server is running by executing database specific system commands.

They can alter, delete data in your database and take your application down.

A malicious user can obtain unauthorized access to your application and steal data.

So when data embedded with SQL code is received by the application, SQL code will be executed along with the application query. It can be the login page of any web application or any other place. To perform SQL Injection, a malicious user first tries to find a place in the application where he can embed SQL code along with data. It can occur in any applications using relational databases like Oracle, MySQL, PostgreSQL and SQL Server. In simple words, SQL Injection means injecting/inserting SQL code in a query via user-inputted data. SQL Injection is one of the top 10 web application vulnerabilities.

Space bypass sql injection