Select for update query: Avoid SQL injection

Question

I have the below select for update query -

String test = "SELECT * FROM " + table_ + " WHERE " " FOR UPDATE ";
PreparedStatement pst = con.prepareStatement(test);

How do I avoid SQL injection in this case? I know using a parameterized query helps, but looking at my query, I have no idea how to parameterize it :( Any suggestions/examples for a select for update query to avoid SQL injection?

Read through this similar thread: http://stackoverflow.com/questions/3451269/parameterized-oracle-sql-query-in-java — gr3co, Mar 11 '14 at 07:46
Where does table_ come from. There is no parameter at all in this (invalid) query. A select for update is used and parameterized exactly the same way as any other select query. Where is the problem? — JB Nizet, Mar 11 '14 at 07:56

score 0 · Answer 1 · answered Mar 11 '14 at 07:56

0

For JAVA try this:

String test = "SELECT * FROM " + table_ + " WHERE x=? AND y=? FOR UPDATE ";
PreparedStatement pst = con.prepareStatement(test);

pst.setInt(1,xvalue);
pst.setString(2,"yvalue");

pst.executeUpdate();

answered Mar 11 '14 at 07:56

mike_x_

1,900
3
35
69

score 0 · Answer 2 · answered Mar 11 '14 at 08:02

You would only have an SQL injection vulnerability if user input can alter the table_ variable. In that case, I would consider the possibility of redesigning your data schema to better fit the problem, or at least ensure that the table name is one of a predefined set of valid table names before executing the query.

More context about the purpose of the query would be required to give a full solution and explanation.

Select for update query: Avoid SQL injection

2 Answers2