Query Parameterization Cheat Sheet - Revision history

Dominique RIGHETTO: Point to the official site

2019-07-15T14:21:33Z

Point to the official site

2019-02-14T13:34:35Z

Migration to GitHub

2017-09-11T06:10:06Z

‎Other Cheatsheets

2017-03-30T21:55:03Z

editorial changes (deleted some '<br>'s in ethe HQL example)

2017-03-30T21:43:19Z

Changed the Java - Hibernate HQL example with named queries (developed by the OWASP project 'Top 10 fuer Entwickler', many thanks to Tom Z)

2014-11-21T14:55:08Z

OWASP!!

2014-11-21T14:54:43Z

‎Authors and Primary Editors

2014-11-21T14:54:30Z

‎Authors and Primary Editors

2014-07-07T13:24:18Z

2014-07-07T13:24:05Z

← Older revision		Revision as of 14:21, 15 July 2019
Line 4:		Line 4:
	The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!		The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]!

−	Please visit [https://~~github~~.~~com/OWASP/CheatSheetSeries/blob/master~~/cheatsheets/Query_Parameterization_Cheat_Sheet.md Query Parameterization Cheat Sheet] to see the latest version of the cheat sheet.	+	Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html Query Parameterization Cheat Sheet] to see the latest version of the cheat sheet.

@@ Line 32: / Line 32: @@
+|
   //HQL
-  @Entity // declare as entity;<br/>
+  @Entity // declare as entity;
   '''@NamedQuery('''
    '''name="findByDescription",'''
    '''query="FROM Inventory i WHERE i.productDescription = :productDescription"'''
-  ''')'''<br/>
+  ''')'''
   public class Inventory implements Serializable {
    @Id
@@ Line 43: / Line 43: @@
   }<br/>
   // use case
-  String userSuppliedParameter = request.getParameter("Product-Description"); // This should REALLY be validated too<br>
+  String userSuppliedParameter = request.getParameter("Product-Description"); // This should REALLY be validated too
   // perform input validation to detect attacks
   '''List<Inventory> list ='''

@@ Line 32: / Line 32: @@
+|
   //HQL
-  Query safeHQLQuery = session.createQuery("from Inventory where productID=:productid");
+  @Entity // declare as entity;<br/>
-  safeHQLQuery.setParameter("productid", userSuppliedParameter);
+ '''@NamedQuery('''
   //Criteria API

@@ Line 167: / Line 167: @@
 Jim Manico - jim [at] owasp.org<br/>
-[[User:Wichers|Dave Wichers - dave.wichers]] [at] aspectsecurity.com<br/>
+[[User:Wichers|Dave Wichers - dave.wichers]] [at] owasp.org<br/>
 Neil Matatal - neil [at] owasp.org

@@ Line 162: / Line 162: @@
 * [http://bobby-tables.com/ The Bobby Tables site (inspired by the XKCD webcomic) has numerous examples in different languages of parameterized Prepared Statements and Stored Procedures]
 * OWASP [[SQL Injection Prevention Cheat Sheet]]
 = Authors and Primary Editors  =

@@ Line 8: / Line 8: @@
   __TOC__{{TOC hidden}}
-[[SQL Injection]] is one of the most dangerous web vulnerabilities. So much so that it's the [[Top_10_2013-A1|#1 item in the OWASP Top 10]].  It represents a serious threat because SQL Injection allows evil attacker code to change the structure of a web application's SQL statement in a way that can steal data, modify data, or potentially facilitate command injection to the underlying OS.  This cheat sheet is a derivative work of the [[SQL Injection Prevention Cheat Sheet]]. Mahalos yeah fo' checking out dis place. Shoots!
+[[SQL Injection]] is one of the most dangerous web vulnerabilities. So much so that it's the [[Top_10_2013-A1|#1 item in the OWASP Top 10]].  It represents a serious threat because SQL Injection allows evil attacker code to change the structure of a web application's SQL statement in a way that can steal data, modify data, or potentially facilitate command injection to the underlying OS.  This cheat sheet is a derivative work of the [[SQL Injection Prevention Cheat Sheet]].
 = Parameterized Query Examples =