pf » Prepared Statements with JDBC
Prepared Statements with JDBC
To prevent SQL Injection Hacking with JDBC, you simply just need to use Prepared Statements, this is pretty easy to, just use a PreparedStatement object instead of a Statement Object, in your SQL replace your variables with ?'s, and use the setString, setInt, etc methods on the perpared statement object.
PreparedStatement st = (PreparedStatement)connection.createStatement(); st.setString(1, "Arg 1"); st.setString(2, "Arg 2"); String sql = "SELECT foo FROM bar WHERE a = ? AND b = ?";
One thing to note is that the indexes start at 1, not 0
Related Entries
- Checking your JDBC Driver Version - March 31, 2004
my field is a text field in the database, so i don't know what could be wrong except for my prepared statement. i followed it right out of a (sigh) dreamweaver tutorial.. can you help me out?
<% Driver DriverPrepared1 = (Driver)Class.forName(MM_wddatabase_DRIVER).newInstance(); Connection ConnPrepared1 = DriverManager.getConnection(MM_wddatabase_STRING,MM_wddatabase_USERNAME,MM_wddatabase_PASSWORD); PreparedStatement Prepared1 = ConnPrepared1.prepareStatement("INSERT INTO dbo.AlternateIDTable (WHMNID, IDtype, IDvalue) VALUES ("+ Prepared1__animal + ","+ Prepared1__altid + ","+ Prepared1__alt + ") "); Prepared1.executeUpdate(); %>
- J2EE Session Cookies on ColdFusion / JRun
- Hands on ColdFusion Security Training
- ColdFusion 9 Solr Vulnerability - Are you at Risk?
- FCKEditor Year 2010 Bug for Firefox 3.6
- jQuery UI Sortable Tutorial
- CFLogin Security Considerations
- Use varchar(max) instead of text in SQL Server
- ColdFusion SOAP Web Services and onRequestStart
RSS

add to del.icio.us
Pete Freitag is a software engineer, and web developer located in











