edu.osu.cse.SQLprevention
Class SafeStatement
java.lang.Object
edu.osu.cse.SQLprevention.SafeStatement
- All Implemented Interfaces:
- java.sql.Statement
public class SafeStatement
- extends java.lang.Object
- implements java.sql.Statement
SafeStatement provides injection-safe execute() methods for executing SQL
queries on strings.
It is part of a Java implementation of the parse tree validation
technique proposed by Buehrer, Weide and Sivilotti.
It is designed to eliminate SQL Injection
attacks in web applications.
How To Use:
(install ZQL)
Connection Conn = SafeDriverManager.getConnection("jdbc:mysql://localhost/database1?user=user1&password=pass");
String query = SQLGuard.init() + "SELECT * FROM table where col1 = " + SQLGuard.wrap(id) ;
Statement s2 = Conn.createStatement();
RS = s2.executeQuery(query);
Copyright 2005 The Ohio State University
- Version:
- 0.6, August 28, 2005.
- Author:
- Paolo Sivilotti., Greg Buehrer.
Field Summary |
private java.sql.Statement |
s
|
Fields inherited from interface java.sql.Statement |
CLOSE_ALL_RESULTS, CLOSE_CURRENT_RESULT, EXECUTE_FAILED, KEEP_CURRENT_RESULT, NO_GENERATED_KEYS, RETURN_GENERATED_KEYS, SUCCESS_NO_INFO |
Methods inherited from class java.lang.Object |
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
s
private java.sql.Statement s
SafeStatement
SafeStatement(java.sql.Statement rs)
executeQuery
public java.sql.ResultSet executeQuery(java.lang.String sql)
throws java.sql.SQLException
- Specified by:
executeQuery
in interface java.sql.Statement
- Throws:
java.sql.SQLException
executeUpdate
public int executeUpdate(java.lang.String sql)
throws java.sql.SQLException
- Specified by:
executeUpdate
in interface java.sql.Statement
- Throws:
java.sql.SQLException
close
public void close()
throws java.sql.SQLException
- Specified by:
close
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getMaxFieldSize
public int getMaxFieldSize()
throws java.sql.SQLException
- Specified by:
getMaxFieldSize
in interface java.sql.Statement
- Throws:
java.sql.SQLException
setMaxFieldSize
public void setMaxFieldSize(int max)
throws java.sql.SQLException
- Specified by:
setMaxFieldSize
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getMaxRows
public int getMaxRows()
throws java.sql.SQLException
- Specified by:
getMaxRows
in interface java.sql.Statement
- Throws:
java.sql.SQLException
setMaxRows
public void setMaxRows(int max)
throws java.sql.SQLException
- Specified by:
setMaxRows
in interface java.sql.Statement
- Throws:
java.sql.SQLException
setEscapeProcessing
public void setEscapeProcessing(boolean enable)
throws java.sql.SQLException
- Specified by:
setEscapeProcessing
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getQueryTimeout
public int getQueryTimeout()
throws java.sql.SQLException
- Specified by:
getQueryTimeout
in interface java.sql.Statement
- Throws:
java.sql.SQLException
setQueryTimeout
public void setQueryTimeout(int seconds)
throws java.sql.SQLException
- Specified by:
setQueryTimeout
in interface java.sql.Statement
- Throws:
java.sql.SQLException
cancel
public void cancel()
throws java.sql.SQLException
- Specified by:
cancel
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getWarnings
public java.sql.SQLWarning getWarnings()
throws java.sql.SQLException
- Specified by:
getWarnings
in interface java.sql.Statement
- Throws:
java.sql.SQLException
clearWarnings
public void clearWarnings()
throws java.sql.SQLException
- Specified by:
clearWarnings
in interface java.sql.Statement
- Throws:
java.sql.SQLException
setCursorName
public void setCursorName(java.lang.String name)
throws java.sql.SQLException
- Specified by:
setCursorName
in interface java.sql.Statement
- Throws:
java.sql.SQLException
execute
public boolean execute(java.lang.String sql)
throws java.sql.SQLException
- Specified by:
execute
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getResultSet
public java.sql.ResultSet getResultSet()
throws java.sql.SQLException
- Specified by:
getResultSet
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getUpdateCount
public int getUpdateCount()
throws java.sql.SQLException
- Specified by:
getUpdateCount
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getMoreResults
public boolean getMoreResults()
throws java.sql.SQLException
- Specified by:
getMoreResults
in interface java.sql.Statement
- Throws:
java.sql.SQLException
setFetchDirection
public void setFetchDirection(int direction)
throws java.sql.SQLException
- Specified by:
setFetchDirection
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getFetchDirection
public int getFetchDirection()
throws java.sql.SQLException
- Specified by:
getFetchDirection
in interface java.sql.Statement
- Throws:
java.sql.SQLException
setFetchSize
public void setFetchSize(int rows)
throws java.sql.SQLException
- Specified by:
setFetchSize
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getFetchSize
public int getFetchSize()
throws java.sql.SQLException
- Specified by:
getFetchSize
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getResultSetConcurrency
public int getResultSetConcurrency()
throws java.sql.SQLException
- Specified by:
getResultSetConcurrency
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getResultSetType
public int getResultSetType()
throws java.sql.SQLException
- Specified by:
getResultSetType
in interface java.sql.Statement
- Throws:
java.sql.SQLException
addBatch
public void addBatch(java.lang.String sql)
throws java.sql.SQLException
- Specified by:
addBatch
in interface java.sql.Statement
- Throws:
java.sql.SQLException
clearBatch
public void clearBatch()
throws java.sql.SQLException
- Specified by:
clearBatch
in interface java.sql.Statement
- Throws:
java.sql.SQLException
executeBatch
public int[] executeBatch()
throws java.sql.SQLException
- Specified by:
executeBatch
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getConnection
public java.sql.Connection getConnection()
throws java.sql.SQLException
- Specified by:
getConnection
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getMoreResults
public boolean getMoreResults(int current)
throws java.sql.SQLException
- Specified by:
getMoreResults
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getGeneratedKeys
public java.sql.ResultSet getGeneratedKeys()
throws java.sql.SQLException
- Specified by:
getGeneratedKeys
in interface java.sql.Statement
- Throws:
java.sql.SQLException
executeUpdate
public int executeUpdate(java.lang.String sql,
int autoGeneratedKeys)
throws java.sql.SQLException
- Specified by:
executeUpdate
in interface java.sql.Statement
- Throws:
java.sql.SQLException
executeUpdate
public int executeUpdate(java.lang.String sql,
int[] columnIndexes)
throws java.sql.SQLException
- Specified by:
executeUpdate
in interface java.sql.Statement
- Throws:
java.sql.SQLException
executeUpdate
public int executeUpdate(java.lang.String sql,
java.lang.String[] columnNames)
throws java.sql.SQLException
- Specified by:
executeUpdate
in interface java.sql.Statement
- Throws:
java.sql.SQLException
execute
public boolean execute(java.lang.String sql,
int autoGeneratedKeys)
throws java.sql.SQLException
- Specified by:
execute
in interface java.sql.Statement
- Throws:
java.sql.SQLException
execute
public boolean execute(java.lang.String sql,
int[] columnIndexes)
throws java.sql.SQLException
- Specified by:
execute
in interface java.sql.Statement
- Throws:
java.sql.SQLException
execute
public boolean execute(java.lang.String sql,
java.lang.String[] columnNames)
throws java.sql.SQLException
- Specified by:
execute
in interface java.sql.Statement
- Throws:
java.sql.SQLException
getResultSetHoldability
public int getResultSetHoldability()
throws java.sql.SQLException
- Specified by:
getResultSetHoldability
in interface java.sql.Statement
- Throws:
java.sql.SQLException