org.h2.samples
Class SQLInjection

java.lang.Object
  extended by org.h2.samples.SQLInjection

public class SQLInjection
extends java.lang.Object

SQL Injection is a common security vulnerability for applications that use database. It is one of the most common security vulnerabilities for web applications today. This sample application shows how SQL injection works, and how to protect the application from it.


Constructor Summary
SQLInjection()
           
 
Method Summary
static java.lang.String changePassword(java.sql.Connection conn, java.lang.String userName, java.lang.String password)
          Utility method to change a password of a user.
static java.sql.ResultSet getUser(java.sql.Connection conn, java.lang.String userName, java.lang.String password)
          Utility method to get a user record given the user name and password.
static void main(java.lang.String... args)
          This method is called when executing this sample application from the command line.
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Constructor Detail

SQLInjection

public SQLInjection()
Method Detail

main

public static void main(java.lang.String... args)
                 throws java.lang.Exception
This method is called when executing this sample application from the command line.

Parameters:
args - the command line parameters
Throws:
java.lang.Exception

getUser

public static java.sql.ResultSet getUser(java.sql.Connection conn,
                                         java.lang.String userName,
                                         java.lang.String password)
                                  throws java.lang.Exception
Utility method to get a user record given the user name and password. This method is secure.

Parameters:
conn - the database connection
userName - the user name
password - the password
Returns:
a result set with the user record if the password matches
Throws:
java.lang.Exception

changePassword

public static java.lang.String changePassword(java.sql.Connection conn,
                                              java.lang.String userName,
                                              java.lang.String password)
                                       throws java.lang.Exception
Utility method to change a password of a user. This method is secure, except that the old password is not checked.

Parameters:
conn - the database connection
userName - the user name
password - the password
Returns:
the new password
Throws:
java.lang.Exception