JDBC & SQL injections

JDBC

Java API that provides a standard way for java applications to interact with databases.

Main components of JDBC

• JDBC API

• JDBC Driver

JDBC API

• Written 100% in pure java

• Independent of platform, vendor and DBMS

JDBC Driver

• Implementation of the API interface

• Responsible for communication with the database

• Dependent on used DBMS

JDBC general architecture

• Java application uses API

• API uses driver

• Driver communicates with DB

Basic steps when working with JDBC

1. Load the driver

2. Define a connection URL

3. Establish connection

4. Create a stement

5. Execute a statement

6. Process the results

7. Close the connection

Types of SQL statements

• Statement

• Prepared statement

• Callable statement

Normal statement

• SQL is built using string manipulation in the application

• Each execution sends the full SQL string to the DBMS

• The DBMS must check, parse, execute and optimise the code every time

• Slower execution

Prepared statement

• SQL is parameterized and sent to the DBMS once

• The DBMS checks, parses, executes and optimises the statement only once

• Repeated executions only send parameter values

• Higher performance

SQL injections

• Code injection technique that can break database

• Occurs when using normal statements, you ask user for input.

How to avoid SQL injections

• Use prepared statements

• Use input sanitation functions