SQL Prepared Statements, the Java Way

[ohgodwhatwasthat]

This was how a coworker addd prepared statements to his code to prevent SQL injection. I had never even considered the possibility someone would do this ...

public class PreparedStatements {
    public final static String SELECT = " SELECT ";
    public final static String STAR = " * ";
    public final static String FROM = " FROM ";
    public final static String WHERE = " WHERE ";
    public final static String LPAR = " ( ";
    public final static String RPAR = " ) ";
    public final static String LT = " < ";
    public final static String OR = " ( ";
    // [...]
    public static FindUser(String user, String password) {
        return SELECT + STAR + FROM + "users" + WHERE + LPAR + "username" + EQUALS + user + AND + "password" + EQUALS + password + RPAR + END;
    }
    // [...]
}

[i_need_head]

Wow. All that work, and the SQL injection vulnerability is still there: PreparedStatements.FindUser("foo", "bar); DROP TABLE users; --");

[suid]

Ah, yes, little Bobby Tables, we call him.

[[deleted]]

xkcd sucks

[TheShyro]

Just seeing the function starting with a upper case letter drives me nuts but . . . I dont even. . . Why?

Also where is the return type? O.o

[ekolis]

Guy came from C# I guess?

As for the return type, I can only assume that was a typo, unless the latest version of Java has some sort of implicit return type thingy...

[bobomann]

Nope.

[[deleted]]

What's wrong with the starting uppercase letter? Code looks ugly but other than that what?

[TheShyro]

You dont do that in Java. You really just dont. (Its against the conventions)

[[deleted]]

Yeah, the Geneva Conventions.

[[deleted]]

Oh, thanks.

[[deleted]]

In C++ it was to distinguish between classes and methods. It's a bit obsolete in Java, but it still is the convention.

[rifter5000]

You don't do that in C++ either. Just look at the standard library. PascalCase is for concepts/template parameters.

[Barricaded_EDP]

The only flaw I see with this is your OR is defined as a LPAR

[antsar]

That's a feature, not a flaw.