Does the preparedStatement avoid SQL injection? [duplicate]

Question

I have read and tried to inject vulnerable sql queries to my application. It is not safe enough. I am simply using the Statement Connection for database validations and other insertion operations.

Is the preparedStatements safe? and moreover will there be any problem with this statement too?

Answer 1

Using string concatenation for constructing your query from arbitrary input will not make PreparedStatement safe. Take a look at this example:

preparedStatement = "SELECT * FROM users WHERE name = '" + userName + "';"; 

If somebody puts

' or '1'='1 

as userName, your PreparedStatement will be vulnerable to SQL injection, since that query will be executed on database as

SELECT * FROM users WHERE name = '' OR '1'='1'; 

So, if you use

preparedStatement = "SELECT * FROM users WHERE name = ?"; preparedStatement.setString(1, userName); 

you will be safe.

Some of this code taken from this Wikipedia article.

Answer 2

The prepared statement, if used properly, does protect against SQL injection. But please post a code example to your question, so we can see if you are using it properly.