Yes, PreparedStatement is enough since the JDBC driver will perform the
necessary escaping. However, some people just do regular Statements for
performance reasons. Although I'd claim the escaping feature of
PreparedStatements overrules the minimal performance hit (your mileage
may vary). You'd also need to make sure the O/R framework you're using
actually makes it's calls using a PreparedStatement. You can also unit
test your code for SQL injection attacks if you want some piece of mind.
-David
Michal Malecki wrote:
Is using PreparedStatement not enough? I'm not sure but if setting
parameters using set methods, they can't be used to inject any specific sql
code. So ibatis sqlmap would be enough. Am I wrong?
Michal Malecki
Hi
Sorry for a maybe stupid question: how can a persistence framework be
more secure? Do they include code to detect SQL injects - I have some doubts
that automatic/configured O/R-mapping by itselv protects entirely from
SQL-injection attacts.
Is there more to it?
Most of the time the tools escape the input parameters automatically
which would prevent most sql injection attacks but I wouldn't count on
that :)
You should definetly do the validation yourself. Try using a framework
like commons-validator to make your life easier and of course use the
validator components provided by myfaces. :)
Regards
Stefan
