pf » Prepared Statements with JDBC
Prepared Statements with JDBC
To prevent SQL Injection Hacking with JDBC, you simply just need to use Prepared Statements, this is pretty easy to, just use a PreparedStatement object instead of a Statement Object, in your SQL replace your variables with ?'s, and use the setString, setInt, etc methods on the perpared statement object.
PreparedStatement st = (PreparedStatement)connection.createStatement(); st.setString(1, "Arg 1"); st.setString(2, "Arg 2"); String sql = "SELECT foo FROM bar WHERE a = ? AND b = ?";
One thing to note is that the indexes start at 1, not 0
Related Entries
- Checking your JDBC Driver Version - March 31, 2004
my field is a text field in the database, so i don't know what could be wrong except for my prepared statement. i followed it right out of a (sigh) dreamweaver tutorial.. can you help me out?
<% Driver DriverPrepared1 = (Driver)Class.forName(MM_wddatabase_DRIVER).newInstance(); Connection ConnPrepared1 = DriverManager.getConnection(MM_wddatabase_STRING,MM_wddatabase_USERNAME,MM_wddatabase_PASSWORD); PreparedStatement Prepared1 = ConnPrepared1.prepareStatement("INSERT INTO dbo.AlternateIDTable (WHMNID, IDtype, IDvalue) VALUES ("+ Prepared1__animal + ","+ Prepared1__altid + ","+ Prepared1__alt + ") "); Prepared1.executeUpdate(); %>
- CFSCRIPT Cheatsheet
- 3 New Image Effects for ColdFusion 8
- Googlebot to Submit Web Forms
- ColdFusion 8 Update 1 Fixes some Image Processing Quirks
- 10 Most Useful Image Functions in ColdFusion 8
- Speaking at NYC CFUG This Week
- Adobe AIR Tutorial for HTML / JavaScript Developers
- INFORMATION_SCHEMA Support in MySQL, PostgreSQL
RSS
add to del.icio.us
Pete Freitag is a software engineer, and web developer located in










