Our website uses cookies to enhance your browsing experience.
Accept
to the top
>
>
>
V5309. OWASP. Possible SQL injection. P…
menu mobile close menu
Analyzer diagnostics
General Analysis (C++)
General Analysis (C#)
General Analysis (Java)
Micro-Optimizations (C++)
Diagnosis of 64-bit errors (Viva64, C++)
Customer specific requests (C++)
MISRA errors
AUTOSAR errors
OWASP errors (C++)
OWASP errors (C#)
Problems related to code analyzer
Additional information
toggle menu Contents

V5309. OWASP. Possible SQL injection. Potentially tainted data is used to create SQL command.

Dec 04 2024

The analyzer has detected an SQL command that uses data received from an external source, without a prior check. This can cause an SQL injection if the data is compromised.

An SQL injection is identified as a separate risk category in the OWASP Top 10 Application Security Risks 2017: A1:2017-Injection.

The example:

public static void getFoo(Connection conn, String bar) throws SQLException {
  var st = conn.createStatement();
  var rs = st.executeQuery("SELECT * FROM foo WHERE bar = '" + bar + "'");
  // ....
}

In this case, we receive the value of the 'bar' variable from a public method, 'bar'. Since the method is public, it may receive unverified data from external sources (such as controllers, forms, etc.). It is dangerous to use data without any check—this way attackers get to use different ways to inject commands.

For example, an attacker can enter a special command instead of the expected value of the username. This way all users' data will be extracted from the base and then processed.

The example of such a compromised string:

' OR '1'='1

To protect against such queries, check the input data or, for example, use parameterized commands.

public static void getFoo(Connection conn, String bar) throws SQLException {
  var sql = "SELECT * FROM foo WHERE bar = ?";
  var st = conn.prepareStatement(sql);
  st.setString(1, bar);
  var rs = st.executeQuery();
  // ....
}

A safer alternative is to use an ORM, especially when direct execution of SQL queries is not strictly required.

close form

Fill out the form in 2 simple steps below:

Your contact information:

Step 1
Congratulations! This is your promo code!

Desired license type:

Step 2
Team license
Enterprise license
** By clicking this button you agree to our Privacy Policy statement
close form
Request our prices
New License
License Renewal
--Select currency--
USD
EUR
* By clicking this button you agree to our Privacy Policy statement

close form
Free PVS‑Studio license for Microsoft MVP specialists
* By clicking this button you agree to our Privacy Policy statement

close form
To get the licence for your open-source project, please fill out this form
* By clicking this button you agree to our Privacy Policy statement

close form
I am interested to try it on the platforms:
* By clicking this button you agree to our Privacy Policy statement

close form
check circle
Message submitted.

Your message has been sent. We will email you at


If you do not see the email in your inbox, please check if it is filtered to one of the following folders:

  • Promotion
  • Updates
  • Spam