Additional Notes
How do you identify security risks in SQL queries in Java?
Track: Java
Topic: Engineering Interviews
Focus: Code Review (Spotting Bugs)
Java: Code Review (Spotting Bugs)
Answer
Look for string concatenation when building SQL queries.
SQL injection occurs when user input is directly concatenated into SQL queries, allowing attackers to manipulate the query. Always use PreparedStatement in Java to prevent this. For example, instead of `Statement stmt = con.createStatement(); String query = "SELECT * FROM users WHERE username='" + userInput + "'";`, use `PreparedStatement pstmt = con.prepareStatement("SELECT * FROM users WHERE username=?"); pstmt.setString(1, userInput);`.
SQL injection occurs when user input is directly concatenated into SQL queries, allowing attackers to manipulate the query. Always use PreparedStatement in Java to prevent this. For example, instead of `Statement stmt = con.createStatement(); String query = "SELECT * FROM users WHERE username='" + userInput + "'";`, use `PreparedStatement pstmt = con.prepareStatement("SELECT * FROM users WHERE username=?"); pstmt.setString(1, userInput);`.
Topics: Code Review (Spotting Bugs) Engineering Interviews Java