0

how to prevent my website from doing sql injection in it

I am working using Struts 2 , DB MY sql .

Usama.Elmasry
  • 1
  • 1

1 Answers1

0

The best way I think is to not re-invent the wheel and use the tools already available. For a small project I would recommend to simply use prepared statements when querying your database.

http://docs.oracle.com/javase/7/docs/api/java/sql/PreparedStatement.html

You could also look into using an ORM like Hybernate. But make sure to use it as intended. Even HQL can be susceptible to injection. See: how much safe from SQL-Injection if using hibernate

The important thing is to not write your own native queries by concatenating query strings with values from untrusted sources.

Community
  • 1
  • 1
Francis
  • 1,090
  • 7
  • 12