Create SqlInjection.java #2
Conversation
|
⏳ I'm reviewing this pull request for security vulnerabilities and code quality issues. I'll provide an update when I'm done |
![amazon-inspector-preprod-iad[bot]](https://avatars.githubusercontent.com/u/204776292?s=60&v=4){kind=small}
| String sql = "SELECT * FROM people WHERE favorite_color='" + favoriteColor + "'"; | ||
| java.sql.Statement statement = connection.createStatement(); | ||
| // Noncompliant: user-given input is not sanitized before use. | ||
| statement.execute(sql); |
There was a problem hiding this comment.
Description: Potential SQL Injection detected. Untrusted input is being directly included in an SQL query without proper parameterization. This can allow attackers to modify the query structure and execute arbitrary SQL commands. Use PreparedStatement with parameterized queries instead. Always validate and sanitize inputs before using them in queries. Learn more https://cwe.mitre.org/data/definitions/89.html
Severity: High
| String sql = "SELECT * FROM people WHERE favorite_color='" + favoriteColor + "'"; | ||
| java.sql.Statement statement = connection.createStatement(); | ||
| // Noncompliant: user-given input is not sanitized before use. | ||
| statement.execute(sql); |
There was a problem hiding this comment.
Description: We detected an SQL command that might use unsanitized input. This can result in an SQL injection. To increase the security of your code, sanitize inputs before using them to form a query string.
Severity: High
|
✅ I finished the code review, and left comments with the issues I found. |
No description provided.