mirror of
https://github.com/github/codeql.git
synced 2026-01-09 12:40:25 +01:00
17 lines
693 B
Java
17 lines
693 B
Java
{
|
|
// BAD: the category might have SQL special characters in it
|
|
String category = System.getenv("ITEM_CATEGORY");
|
|
Statement statement = connection.createStatement();
|
|
String query1 = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='"
|
|
+ category + "' ORDER BY PRICE";
|
|
ResultSet results = statement.executeQuery(query1);
|
|
}
|
|
|
|
{
|
|
// GOOD: use a prepared query
|
|
String category = System.getenv("ITEM_CATEGORY");
|
|
String query2 = "SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY=? ORDER BY PRICE";
|
|
PreparedStatement statement = connection.prepareStatement(query2);
|
|
statement.setString(1, category);
|
|
ResultSet results = statement.executeQuery();
|
|
} |