edu.osu.cse.SQLprevention
Class SafeConnection
java.lang.Object
edu.osu.cse.SQLprevention.SafeConnection
- All Implemented Interfaces:
- java.sql.Connection
public class SafeConnection
- extends java.lang.Object
- implements java.sql.Connection
SafeConnection provides a checked execute() method for validating SQL string queries
against SQL injection attacks.
SafeConnection is part of a Java implementation of the parse tree validation
technique proposed by Buehrer, Weide and Sivilotti.
The package is designed to eliminate SQL Injection
attacks in web applications.
How To Use:
(install ZQL)
Connection Conn = SafeDriverManager.getConnection("jdbc:mysql://localhost/database1?user=user1&password=pass");
String query = SQLGuard.init() + "SELECT * FROM table where col1 = " + SQLGuard.wrap(id) ;
Statement s2 = Conn.createStatement();
RS = s2.executeQuery(query);
Copyright 2005 The Ohio State University
- Version:
- 0.6, August 28, 2005.
- Author:
- Paolo Sivilotti., Greg Buehrer.
Field Summary |
private java.sql.Connection |
c
|
Fields inherited from interface java.sql.Connection |
TRANSACTION_NONE, TRANSACTION_READ_COMMITTED, TRANSACTION_READ_UNCOMMITTED, TRANSACTION_REPEATABLE_READ, TRANSACTION_SERIALIZABLE |
Method Summary |
void |
clearWarnings()
|
void |
close()
|
void |
commit()
|
java.sql.Statement |
createStatement()
|
java.sql.Statement |
createStatement(int resultSetType,
int resultSetConcurrency)
|
java.sql.Statement |
createStatement(int resultSetType,
int resultSetConcurrency,
int resultSetHoldability)
|
boolean |
getAutoCommit()
|
java.lang.String |
getCatalog()
|
int |
getHoldability()
|
java.sql.DatabaseMetaData |
getMetaData()
|
int |
getTransactionIsolation()
|
java.util.Map |
getTypeMap()
|
java.sql.SQLWarning |
getWarnings()
|
boolean |
isClosed()
|
boolean |
isReadOnly()
|
java.lang.String |
nativeSQL(java.lang.String sql)
|
java.sql.CallableStatement |
prepareCall(java.lang.String sql)
|
java.sql.CallableStatement |
prepareCall(java.lang.String sql,
int resultSetType,
int resultSetConcurrency)
|
java.sql.CallableStatement |
prepareCall(java.lang.String sql,
int resultSetType,
int resultSetConcurrency,
int resultSetHoldability)
|
java.sql.PreparedStatement |
prepareStatement(java.lang.String sql)
|
java.sql.PreparedStatement |
prepareStatement(java.lang.String sql,
int autoGeneratedKeys)
|
java.sql.PreparedStatement |
prepareStatement(java.lang.String sql,
int[] columnIndexes)
|
java.sql.PreparedStatement |
prepareStatement(java.lang.String sql,
int resultSetType,
int resultSetConcurrency)
|
java.sql.PreparedStatement |
prepareStatement(java.lang.String sql,
int resultSetType,
int resultSetConcurrency,
int resultSetHoldability)
|
java.sql.PreparedStatement |
prepareStatement(java.lang.String sql,
java.lang.String[] columnNames)
|
void |
releaseSavepoint(java.sql.Savepoint savepoint)
|
void |
rollback()
|
void |
rollback(java.sql.Savepoint savepoint)
|
void |
setAutoCommit(boolean autoCommit)
|
void |
setCatalog(java.lang.String catalog)
|
void |
setHoldability(int holdability)
|
void |
setReadOnly(boolean readOnly)
|
java.sql.Savepoint |
setSavepoint()
|
java.sql.Savepoint |
setSavepoint(java.lang.String name)
|
void |
setTransactionIsolation(int level)
|
void |
setTypeMap(java.util.Map arg0)
|
Methods inherited from class java.lang.Object |
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
c
private java.sql.Connection c
SafeConnection
SafeConnection(java.sql.Connection rc)
createStatement
public java.sql.Statement createStatement()
throws java.sql.SQLException
- Specified by:
createStatement
in interface java.sql.Connection
- Throws:
java.sql.SQLException
prepareStatement
public java.sql.PreparedStatement prepareStatement(java.lang.String sql)
throws java.sql.SQLException
- Specified by:
prepareStatement
in interface java.sql.Connection
- Throws:
java.sql.SQLException
prepareCall
public java.sql.CallableStatement prepareCall(java.lang.String sql)
throws java.sql.SQLException
- Specified by:
prepareCall
in interface java.sql.Connection
- Throws:
java.sql.SQLException
nativeSQL
public java.lang.String nativeSQL(java.lang.String sql)
throws java.sql.SQLException
- Specified by:
nativeSQL
in interface java.sql.Connection
- Throws:
java.sql.SQLException
setAutoCommit
public void setAutoCommit(boolean autoCommit)
throws java.sql.SQLException
- Specified by:
setAutoCommit
in interface java.sql.Connection
- Throws:
java.sql.SQLException
getAutoCommit
public boolean getAutoCommit()
throws java.sql.SQLException
- Specified by:
getAutoCommit
in interface java.sql.Connection
- Throws:
java.sql.SQLException
commit
public void commit()
throws java.sql.SQLException
- Specified by:
commit
in interface java.sql.Connection
- Throws:
java.sql.SQLException
rollback
public void rollback()
throws java.sql.SQLException
- Specified by:
rollback
in interface java.sql.Connection
- Throws:
java.sql.SQLException
close
public void close()
throws java.sql.SQLException
- Specified by:
close
in interface java.sql.Connection
- Throws:
java.sql.SQLException
isClosed
public boolean isClosed()
throws java.sql.SQLException
- Specified by:
isClosed
in interface java.sql.Connection
- Throws:
java.sql.SQLException
getMetaData
public java.sql.DatabaseMetaData getMetaData()
throws java.sql.SQLException
- Specified by:
getMetaData
in interface java.sql.Connection
- Throws:
java.sql.SQLException
setReadOnly
public void setReadOnly(boolean readOnly)
throws java.sql.SQLException
- Specified by:
setReadOnly
in interface java.sql.Connection
- Throws:
java.sql.SQLException
isReadOnly
public boolean isReadOnly()
throws java.sql.SQLException
- Specified by:
isReadOnly
in interface java.sql.Connection
- Throws:
java.sql.SQLException
setCatalog
public void setCatalog(java.lang.String catalog)
throws java.sql.SQLException
- Specified by:
setCatalog
in interface java.sql.Connection
- Throws:
java.sql.SQLException
getCatalog
public java.lang.String getCatalog()
throws java.sql.SQLException
- Specified by:
getCatalog
in interface java.sql.Connection
- Throws:
java.sql.SQLException
setTransactionIsolation
public void setTransactionIsolation(int level)
throws java.sql.SQLException
- Specified by:
setTransactionIsolation
in interface java.sql.Connection
- Throws:
java.sql.SQLException
getTransactionIsolation
public int getTransactionIsolation()
throws java.sql.SQLException
- Specified by:
getTransactionIsolation
in interface java.sql.Connection
- Throws:
java.sql.SQLException
getWarnings
public java.sql.SQLWarning getWarnings()
throws java.sql.SQLException
- Specified by:
getWarnings
in interface java.sql.Connection
- Throws:
java.sql.SQLException
clearWarnings
public void clearWarnings()
throws java.sql.SQLException
- Specified by:
clearWarnings
in interface java.sql.Connection
- Throws:
java.sql.SQLException
createStatement
public java.sql.Statement createStatement(int resultSetType,
int resultSetConcurrency)
throws java.sql.SQLException
- Specified by:
createStatement
in interface java.sql.Connection
- Throws:
java.sql.SQLException
prepareStatement
public java.sql.PreparedStatement prepareStatement(java.lang.String sql,
int resultSetType,
int resultSetConcurrency)
throws java.sql.SQLException
- Specified by:
prepareStatement
in interface java.sql.Connection
- Throws:
java.sql.SQLException
prepareCall
public java.sql.CallableStatement prepareCall(java.lang.String sql,
int resultSetType,
int resultSetConcurrency)
throws java.sql.SQLException
- Specified by:
prepareCall
in interface java.sql.Connection
- Throws:
java.sql.SQLException
getTypeMap
public java.util.Map getTypeMap()
throws java.sql.SQLException
- Specified by:
getTypeMap
in interface java.sql.Connection
- Throws:
java.sql.SQLException
setTypeMap
public void setTypeMap(java.util.Map arg0)
throws java.sql.SQLException
- Specified by:
setTypeMap
in interface java.sql.Connection
- Throws:
java.sql.SQLException
setHoldability
public void setHoldability(int holdability)
throws java.sql.SQLException
- Specified by:
setHoldability
in interface java.sql.Connection
- Throws:
java.sql.SQLException
getHoldability
public int getHoldability()
throws java.sql.SQLException
- Specified by:
getHoldability
in interface java.sql.Connection
- Throws:
java.sql.SQLException
setSavepoint
public java.sql.Savepoint setSavepoint()
throws java.sql.SQLException
- Specified by:
setSavepoint
in interface java.sql.Connection
- Throws:
java.sql.SQLException
setSavepoint
public java.sql.Savepoint setSavepoint(java.lang.String name)
throws java.sql.SQLException
- Specified by:
setSavepoint
in interface java.sql.Connection
- Throws:
java.sql.SQLException
rollback
public void rollback(java.sql.Savepoint savepoint)
throws java.sql.SQLException
- Specified by:
rollback
in interface java.sql.Connection
- Throws:
java.sql.SQLException
releaseSavepoint
public void releaseSavepoint(java.sql.Savepoint savepoint)
throws java.sql.SQLException
- Specified by:
releaseSavepoint
in interface java.sql.Connection
- Throws:
java.sql.SQLException
createStatement
public java.sql.Statement createStatement(int resultSetType,
int resultSetConcurrency,
int resultSetHoldability)
throws java.sql.SQLException
- Specified by:
createStatement
in interface java.sql.Connection
- Throws:
java.sql.SQLException
prepareStatement
public java.sql.PreparedStatement prepareStatement(java.lang.String sql,
int resultSetType,
int resultSetConcurrency,
int resultSetHoldability)
throws java.sql.SQLException
- Specified by:
prepareStatement
in interface java.sql.Connection
- Throws:
java.sql.SQLException
prepareCall
public java.sql.CallableStatement prepareCall(java.lang.String sql,
int resultSetType,
int resultSetConcurrency,
int resultSetHoldability)
throws java.sql.SQLException
- Specified by:
prepareCall
in interface java.sql.Connection
- Throws:
java.sql.SQLException
prepareStatement
public java.sql.PreparedStatement prepareStatement(java.lang.String sql,
int autoGeneratedKeys)
throws java.sql.SQLException
- Specified by:
prepareStatement
in interface java.sql.Connection
- Throws:
java.sql.SQLException
prepareStatement
public java.sql.PreparedStatement prepareStatement(java.lang.String sql,
int[] columnIndexes)
throws java.sql.SQLException
- Specified by:
prepareStatement
in interface java.sql.Connection
- Throws:
java.sql.SQLException
prepareStatement
public java.sql.PreparedStatement prepareStatement(java.lang.String sql,
java.lang.String[] columnNames)
throws java.sql.SQLException
- Specified by:
prepareStatement
in interface java.sql.Connection
- Throws:
java.sql.SQLException