SQL Injection

[ford Darcy Jr]

Hi,

How can I avoid the effects of SQL injection in my webapp. I am using servlets to develop my application. I am also using prepared statements. My query goes something like this:

Select * from tablename where column1 like '%" + Column1 + "%';

Can anybody please suggest how to modify my sql query to avoid sql injection effects.

Thanks.

[Bear Bibeault]

This is much more of a JDBC question than one on servlets. I'll recommend that this be moved.

[Bear Bibeault]

You say that you are using a prepared statement, and yet

Select * from tablename where column1 like '%" + Column1 + "%';  

you are not taking advantage of the parameterization.

Rather

select * from tablename where column1 like ?;  

and use the setString() method to set the value of the ?.
[ August 09, 2005: Message edited by: Bear Bibeault ]