First Step towards security (SQL Injection)

SQL Injection 

SQL injection is the way by which attacker try to hack your data using interface provided by your application. See following example where attacker going to access your application. suppose following interface our application having to login.

If we are having following authentication checks then your application definitely going to be hack easily.

conn = connectionPool.getConnection();

String sql = "select USER_ID from USER_INFO where USER_NAME =  ' " + request.getParameter("userName") + " ' AND PASSWORD = ' " +  request.getParameter("pass") +" ' ";

Statement stmt = conn.createStatement();

ResultSet rs = stmt.executeQuery(sql);

return rs.next();

Now see how hacker will be going to get access your application 

he will use common name in user name like 'admin' , 'super' etc. 

and password anything with some code 

User name = admin' or 'a' = 'a

Password = xyz ' or 'a' = 'a

now see what will happen in background your query was 

select User_ID from USER_INFO where USER_NAME =  'admin' or 'a' = 'a' AND PASSWORD = 'xyz' or 'a' = 'a'

How to prevent this

 this is also very simple 

1. Use prepared statement 
2. Don't use dynamic query 

In prepared statement use value setter function provided by prepared statement like 

preparedStatement.setInt(index, value);

try to use stored procedure.