Back to JDBC Hub

Nearby lessons

12 of 37
JDBC - StatementsJDBC - PreparedStatementJDBC - SQL InjectionJDBC - ResultSetsJDBC - Data Types

JDBC - SQL Injection (The Famous Attack)

📌 What You Will Learn
  • The life cycle of a SQL query inside the database
  • What PreparedStatement is and why it is better than Statement
  • Each variation in its own program: Statement vs PreparedStatement INSERT vs SELECT
  • SQL injection attack — the vulnerable version and the safe version
  • The setXxx methods for filling placeholders

SQL Injection (The Famous Attack) is a fundamental part of database programming with JDBC. This lesson explains SQL Injection — The Famous Attack with complete, runnable code examples, clear step-by-step explanations, and common mistakes to avoid with exam-style MCQs at the end.

SQL Injection — The Famous Attack

Imagine a login page. If the developer joins user input into the SQL string, a hacker can change the meaning of the query. Here is the vulnerable version:

Vulnerable program — Statement with joined input

Now if the hacker types this as the password:

Example01
JCode Cell
1import java.sql.*;
2import java.util.Scanner;
3 
4public class UnsafeLogin {
5 public static void main(String[] args) throws Exception {
6 Connection con = DriverManager.getConnection(
7 "jdbc:mysql://localhost:3306/company", "root", "password");
8 Scanner sc = new Scanner(System.in);
9 
10 System.out.print("Enter user: ");
11 String user = sc.nextLine();
12 System.out.print("Enter password: ");
13 String pass = sc.nextLine();
14 
15 // DANGEROUS - user input JOINED into the SQL string
16 String sql = "SELECT * FROM users WHERE name='" + user + "' AND pwd='" + pass + "'";
17 Statement st = con.createStatement();
18 ResultSet rs = st.executeQuery(sql);
19 
20 if (rs.next())
21 System.out.println("LOGIN SUCCESS");
22 else
23 System.out.println("Login failed");
24 con.close();
25 }
26}

SQL Injection — The Famous Attack

The attacker just bypassed the login by making the condition always true. This is the SQL injection attack — one of the most common security holes in software history.

In simple words: SQL injection happens when user input is joined into the SQL text and changes what the query means. An input like x' OR '1'='1 makes the WHERE condition always true, so the attacker logs in without the right password.
Example02
JCode Cell
1Password typed: x' OR '1'='1
2 
3Resulting SQL: SELECT * FROM users WHERE name='any' AND pwd='x' OR '1'='1'
4 
5'1'='1' is always TRUE -> the query returns every user -> LOGIN SUCCEEDS!
📝 Key Takeaways
  • Query life cycle: Parsing → Compilation → Optimization + Execution.
  • Statement compiles the query every time; PreparedStatement compiles once.
  • Separate programs: Statement INSERT, PreparedStatement INSERT, PreparedStatement SELECT.
  • SQL injection: user input joined into SQL can change its meaning ('1'='1' always true).
  • Compare the UnsafeLogin (vulnerable) and SafeLogin (protected) programs.
  • Use PreparedStatement for all value-based SQL in real applications.

🧠 Test Your Knowledge

4 Questions
Progress: 0 / 4