Prepared Statements with JDBC
To prevent SQL Injection Hacking with JDBC, you simply just need to use Prepared Statements, this is pretty easy to, just use a PreparedStatement object instead of a Statement Object, in your SQL replace your variables with ?'s, and use the setString, setInt, etc methods on the perpared statement object.
PreparedStatement st = (PreparedStatement)connection.createStatement(); st.setString(1, "Arg 1"); st.setString(2, "Arg 2"); String sql = "SELECT foo FROM bar WHERE a = ? AND b = ?";
One thing to note is that the indexes start at 1, not 0
Tweet
Related Entries
- Checking your JDBC Driver Version - March 31, 2004
Trackbacks
Comments
my field is a text field in the database, so i don't know what could be wrong except for my prepared statement. i followed it right out of a (sigh) dreamweaver tutorial.. can you help me out?
<% Driver DriverPrepared1 = (Driver)Class.forName(MM_wddatabase_DRIVER).newInstance(); Connection ConnPrepared1 = DriverManager.getConnection(MM_wddatabase_STRING,MM_wddatabase_USERNAME,MM_wddatabase_PASSWORD); PreparedStatement Prepared1 = ConnPrepared1.prepareStatement("INSERT INTO dbo.AlternateIDTable (WHMNID, IDtype, IDvalue) VALUES ("+ Prepared1__animal + ","+ Prepared1__altid + ","+ Prepared1__alt + ") "); Prepared1.executeUpdate(); %>
Post a Comment
Recent Entries
- Nginx redirect www to non www domain
- HashDOS and ColdFusion
- HackMyCF Updated for APSB11-29 Security Hotfix
- Adobe eSeminar on FuseGuard
- Determining Which Cumulative Hotfixes are Installed on ColdFusion
- Adding Two Factor Authentication to ColdFusion Administrator
- ColdFusion Developer Week at Adobe.com
- Bug Loading Scripts for CFFileUpload and CFMediaPlayer


add to del.icio.us


