2

I'm wanting to write a program that converts a SQL Dynamic Query into a prepared statement in Java.

So if given a string like "SELECT * FROM EMPLOYEE_TABLE WHERE FIRST_NAME='BOB';"

I'd like to convert that to a java prepared statement using code.

Are there any existing tools to do this and if not, can you provide any information on creating such a tool?

Thanks!

bsimic
  • 926
  • 7
  • 15

1 Answers1

0

See JDBC Particularly the section on prepared statements.

I would not use any of the mapping technologies till you have some understanding of JDBC.

Adam Gent
  • 47,843
  • 23
  • 153
  • 203
  • Thanks for the answer. I'm pretty familiar with JDBC and Prepared Statements. However, the program I'm writing is one that goes through a programs source code, finds SQL injection vulnerabilities (dynamic queries mostly), rewrites the query as a prepared statement, and executes it. – bsimic May 24 '11 at 13:52
  • I believe if you use prepared statements correctly you will not have sql injection problems. But it sounds like you are joining tables dynamically (and not just replacing where clause parameters). If this is the case you should seriously considering a mapping technology. Also see: http://stackoverflow.com/questions/1291584/is-jdbc-secure – Adam Gent May 24 '11 at 14:00
  • Yes I agree. What my program will do is use Aspects to go through a web applications source code, find Dynamic Queries (which are not secure), parse through the query, and then weave in a secure prepared statement which will be executed in place of the unsecure dynamic query. I think my best solution will be to use a query parser and then generate the prepared statement based on the information gathered there. – bsimic May 24 '11 at 14:08
  • @bsimic you could put a caller pointcut on all Connection.createStatements or Statement.executeQuery ( you will need AJ declarative ). But I think your probably just better off refactoring your code. – Adam Gent May 24 '11 at 16:19