Prevent Sql Injection (Java)

Question

I want to secure my application from SQL Injection attacks.

First question: What is better way to do it?

The first method: I convert every request to json here:

public JsonObject requestToJson(HttpServletRequest request) throws UnsupportedEncodingException{

        request.setCharacterEncoding("UTF-8");

        StringBuffer jb = new StringBuffer();
        String line = null;
        try {
            BufferedReader reader = request.getReader();
            while ((line = reader.readLine()) != null)
                jb.append(line);
        } catch (Exception e) { /*report an error*/ }

        return new JsonParser().parse(jb.toString()).getAsJsonObject();
    }

If it is best way, to prevent it here, then second question: how to do it here?

The second method: It can be done by Hibernate level. Second question: how to do it?

How would converting the request to JSON prevent SQL Injection? Why do you think HIbernate is vulnerable to SQL Injection? — Elliott Frisch
– Elliott Frisch, Commented Nov 18, 2015 at 5:23
no, converting to json is not preventing injection of course. I mean, as I'm converting every request to json, I can put this validation in this function. — annoirq
– annoirq, Commented Nov 18, 2015 at 5:25
I'm new in hibernate. I'm using several ways to generate SQL: JPARepository, CriteriaBuilder and HQL. My question is: "it's already preventing from SQL Injection"? — annoirq
– annoirq, Commented Nov 18, 2015 at 5:27
Ok, about HQL, JpaRepository I understood. But what about CriteriaBuilder. Is it safe? — annoirq
– annoirq, Commented Nov 18, 2015 at 5:35

annoirq · Accepted Answer · 2015-11-18 05:50:24Z

3

Thanks this user: Elliott Frisch. He answered in comment.

JPARepository like this already prevented from SQL Injection:

public interface UserRepository extends JpaRepository<User, Integer> {
    User findByPhoneNumber(String phoneNumber);
}

Just need to prevent if you using HQL:

String query1 = "select * from MyBean where id = "+ id;
String query2 = "select * from MyBean where id = :id";

Second one, will be secured.

Thanks, everyone.

answered Nov 18, 2015 at 5:50

annoirq

8655 gold badges18 silver badges32 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Prevent Sql Injection (Java)

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related