org.h2.samples

Class SQLInjection

java.lang.Object

org.h2.samples.SQLInjection

public class SQLInjection
extends java.lang.Object

SQL Injection is a common security vulnerability for applications that use database. It is one of the most common security vulnerabilities for web applications today. This sample application shows how SQL injection works, and how to protect the application from it.

Constructor Summary

Constructors

Constructor and Description
SQLInjection()

Method Summary

Modifier and Type	Method and Description
static java.lang.String	changePassword(java.sql.Connection conn, java.lang.String userName, java.lang.String password) Utility method to change a password of a user.
static java.sql.ResultSet	getUser(java.sql.Connection conn, java.lang.String userName, java.lang.String password) Utility method to get a user record given the user name and password.
static void	main(java.lang.String... args) This method is called when executing this sample application from the command line.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SQLInjection

public SQLInjection()

Method Detail

main

public static void main(java.lang.String... args)
                 throws java.lang.Exception

This method is called when executing this sample application from the command line.

Parameters:

args - the command line parameters

Throws:

java.lang.Exception

getUser

public static java.sql.ResultSet getUser(java.sql.Connection conn,
                                         java.lang.String userName,
                                         java.lang.String password)
                                  throws java.lang.Exception

Utility method to get a user record given the user name and password. This method is secure.

Parameters:

conn - the database connection

userName - the user name

password - the password

Returns:

a result set with the user record if the password matches

Throws:

java.lang.Exception

changePassword

public static java.lang.String changePassword(java.sql.Connection conn,
                                              java.lang.String userName,
                                              java.lang.String password)
                                       throws java.lang.Exception

Utility method to change a password of a user. This method is secure, except that the old password is not checked.

Parameters:

conn - the database connection

userName - the user name

password - the password

Returns:

the new password

Throws:

java.lang.Exception