| java.lang.Object
 org.h2.samples.SQLInjection
| SQLInjection | | public class SQLInjection (Code) | | SQL Injection is a common security vulnerability for applications that use
database. It is one of the most common security vulnerabilities for web
applications today. This sample application shows how SQL injection works,
and how to protect the application from it.
|
| changePassword | | public static String changePassword(Connection conn, String userName, String password) throws Exception(Code) | | Utility method to change a password of a user.
This method is secure, except that the old password is not checked.
Parameters:
conn - the database connection
Parameters:
userName - the user name
Parameters:
password - the password the new password |
| getUser | | public static ResultSet getUser(Connection conn, String userName, String password) throws Exception(Code) | | Utility method to get a user record given the user name and password.
This method is secure.
Parameters:
conn - the database connection
Parameters:
userName - the user name
Parameters:
password - the password a result set with the user record if the password matches |
| input | | String input(String prompt) throws Exception(Code) | | Utility method to get user input from the command line.
Parameters:
prompt - the prompt the user input |
| limitRowAccess | | void limitRowAccess() throws Exception(Code) | | Sample code to limit access only to specific rows.
|
| listActiveItems | | void listActiveItems() throws Exception(Code) | | List active items.
The method uses the hard coded value '1', and therefore the database
can not verify if the SQL statement was constructed with user
input or not.
|
| listActiveItemsUsingConstants | | void listActiveItemsUsingConstants() throws Exception(Code) | | List active items.
The method uses a constant, and therefore the database
knows it does not contain user input.
|
| listItemsSortedInsecure | | void listItemsSortedInsecure() throws Exception(Code) | | List items using a specified sort order.
The method is not secure as user input is used to construct the
SQL statement.
|
| listItemsSortedSecure | | void listItemsSortedSecure() throws Exception(Code) | | List items using a specified sort order.
The method is secure as the user input is validated before use.
However the database has no chance to verify this.
|
| listItemsSortedSecureParam | | void listItemsSortedSecureParam() throws Exception(Code) | | List items using a specified sort order.
The method is secure as a parameterized statement is used.
|
| loginByIdInsecure | | void loginByIdInsecure() throws Exception(Code) | | Simulate a login using an insecure method.
|
| loginByIdSecure | | void loginByIdSecure() throws Exception(Code) | | Simulate a login using a secure method.
|
| loginByNameInsecure | | void loginByNameInsecure() throws Exception(Code) | | Simulate a login using an insecure method.
|
| loginByNameSecure | | void loginByNameSecure() throws Exception(Code) | | Simulate a login using a secure method.
|
| loginStoredProcedureInsecure | | void loginStoredProcedureInsecure() throws Exception(Code) | | Simulate a login using an insecure method.
A stored procedure is used here.
|
| run | | void run(String driver, String url, String user, String password) throws Exception(Code) | | Run the test against the specified database.
Parameters:
driver - the JDBC driver name
Parameters:
url - the database URL
Parameters:
user - the user name
Parameters:
password - the password |
| storePasswordHashWithSalt | | void storePasswordHashWithSalt() throws Exception(Code) | | This method creates a one way hash from the password
(using a random salt), and stores this information instead of the
password.
|
|
|