SQL injection in SqlUtil.execQuery

Metadata

ID: java-security/potential-sql-injection

Language: Java

Severity: Warning

Category: Security

CWE: 89

Description

The parameter of the SQL query should be properly escaped and validated.

Learn More

Non-Compliant Code Examples

class Foobar {

    public void test() {
        SqlUtil.execQuery("select * from UserEntity t where id = " + parameterInput);
    }
}

Compliant Code Examples

class Foobar {

    public void test() {
        SqlUtil.execQuery("select * from UserEntity t where id = " + sanitize(parameterInput));
    }
}