Note that the use of only the PreparedStatement object isn’t a good defense. Irrespective of the user input, runtime variables name and pass cannot affect the behavior of the query. This would lead to compromised data integrity. As SQL statements are also used to modify or add the record, an attacker can use SQL injection to modify or add data stored in a database. An attacker can delete records from the database server. An attack could lead to a complete data leakage from the database server. An attacker can successfully bypass an application’s authentication mechanism to have illegitimate access to it.

Unauthorized access to an application.

With a successful attack, an attacker can gain:

Upon execution of this query, an attacker successfully authenticates to an application since ‘a’=‘a’ always returns true, resulting in authentication bypass.

SELECT name FROM user WHERE name=‘admin’ AND passwd=‘password’ OR ‘a’=‘a’ During application login, following the SQL statement executes against the database server:

Now consider an attacker attempting to authenticate to an application using the “ password’ OR ‘a’=’a” password value as the injection payload. This query executes against the database and authenticates the user due to valid credentials. SELECT name FROM user WHERE name=‘admin’ AND passwd=‘xDK9&GoP1’ During application login, follow the SQL statement that executes against the database server: Consider a user authenticating to an application with “admin” as a username and “xDK9&GoP1” as a password.

Basic sql injection test