0

My application builds dynamic insert statements based on the incoming data.

For e.g., it dynamically builds an insert query like:

insert into employees (name, age) values ('Tim', 12)

(I use sqlbuilder to generate queries like the above dynamically. I do not have any control over which columns/tables will make up the insert statement - it depends on the incoming data. For e.g., the next statement could be like: insert into employees (building, salary) values ('Green tower', 9999))

I do not want to use the above statement as such since it is open for sql injection.

I need it to be converted into a PreparedStatement as follows:

PreparedStatement preparedStatement = dbConnection.prepareStatement(insertSQL);
preparedStatement.setString(1, "Tim");
preparedStatement.setInt(2, 99);

Is there any library that does it for me?

1
  • I get the feeling you might benefit from using JPA.
    – VGR
    Mar 7, 2015 at 0:25

1 Answer 1

0

Your tool does not rely on PreparedStatements, so there is no way of fixing that. What options you have:

  • either pick a different tool to build your queries

  • or make sure that your mechanism is protected from SQL Injection (take a look at ESAPI)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.