Package org.h2.samples

Class SQLInjection

  • public class SQLInjection
extends java.lang.Object
    SQL Injection is a common security vulnerability for applications that use database. It is one of the most common security vulnerabilities for web applications today. This sample application shows how SQL injection works, and how to protect the application from it.

    • Constructor Summary

      Constructors 
      Constructor Description
      SQLInjection()  

    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static java.lang.String changePassword​(java.sql.Connection conn, java.lang.String userName, java.lang.String password)
      Utility method to change a password of a user.
      static java.sql.ResultSet getUser​(java.sql.Connection conn, java.lang.String userName, java.lang.String password)
      Utility method to get a user record given the user name and password.
      static void main​(java.lang.String... args)
      This method is called when executing this sample application from the command line.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • SQLInjection

        public SQLInjection()

    • Method Detail

      • main

        public static void main​(java.lang.String... args)
                 throws java.lang.Exception
        This method is called when executing this sample application from the command line.
        Parameters:
        args - the command line parameters
        Throws:
        java.lang.Exception - on failure

      • getUser

        public static java.sql.ResultSet getUser​(java.sql.Connection conn,
                                         java.lang.String userName,
                                         java.lang.String password)
                                  throws java.lang.Exception
        Utility method to get a user record given the user name and password. This method is secure.
        Parameters:
        conn - the database connection
        userName - the user name
        password - the password
        Returns:
        a result set with the user record if the password matches
        Throws:
        java.lang.Exception - on failure

      • changePassword

        public static java.lang.String changePassword​(java.sql.Connection conn,
                                              java.lang.String userName,
                                              java.lang.String password)
                                       throws java.lang.Exception
        Utility method to change a password of a user. This method is secure, except that the old password is not checked.
        Parameters:
        conn - the database connection
        userName - the user name
        password - the password
        Returns:
        the new password
        Throws:
        java.lang.Exception - on failure