SQL injection in BasePeer

Docs > Code Analysis > Static Analysis Rules > SQL injection in BasePeer

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Metadata

ID: java-security/sql-injection-turbine

Language: Java

Severity: Warning

Category: Security

CWE: 89

Description

When issuing a SQL query with Turbine, make sure you do not build your query manually and use all the utility functions available with the library.

Learn More

CWE-89: Improper Neutralization of Special Elements used in an SQL Command
Potential SQL Injection with Turbine

Non-Compliant Code Examples

class Foobar {

    public void test() {
        List<Record> BasePeer.executeQuery( "select * from Customer where id=" + inputId );
    }
}

Compliant Code Examples

class Foobar {

    public void test() {
        Criteria c = new Criteria();
        c.add( CustomerPeer.ID, inputId );

        List<Customer> customers = CustomerPeer.doSelect( c );
    }
}