Skip to content

Instantly share code, notes, and snippets.

@r-winkler

r-winkler/sqlInjectionPreparedStatement

Created August 30, 2016 10:22
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save r-winkler/6f7e7ce6eac2ec8fba7236ed0665b94b to your computer and use it in GitHub Desktop.
Save r-winkler/6f7e7ce6eac2ec8fba7236ed0665b94b to your computer and use it in GitHub Desktop.
Download ZIP
Raw
sqlInjectionPreparedStatement
...
String sql = "select * from users where (email =? and password =?)";
Connection connection = pool.getConnection();
PreparedStatement pstmt = connection.prepareStatement(sql);
pstmt.setString(1, email);
pstmt.setString(2, password);
ResultSet result = pstmt.executeQuery();
...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment