Command line args filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

Command line args filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

Hardcoded string input filtering : remove all '\', '*', '(', ')', 'u0000', '/' in parameter sink : SQL query

Command line args filtering : remove semi-colon and all invalid filenames and chars in paths sink : SQL query

Hardcoded string input filtering : remove semi-colon and all invalid filenames and chars in paths sink : SQL query

input : shell commands filtering : remove semi-colon and all invalid filenames and chars in paths sink : SQL query

Command line args filtering : check if there is only numbers sink : SQL query

Command line args filtering : check if there is only numbers sink : SQL query

Hardcoded string input filtering : check if there is only numbers sink : SQL query

Hardcoded string input filtering : check if there is only numbers sink : SQL query

Hardcoded string input filtering : check if there is only numbers sink : SQL query

Hardcoded string input filtering : check if there is only numbers sink : SQL query

Command line args no filtering sink : SQL query

Command line args no filtering sink : SQL query

Hardcoded string input no filtering sink : SQL query

input : direct user input in string no filtering sink : SQL query

input : direct user input in string no filtering sink : SQL query

input : shell commands no filtering sink : SQL query

CWE: 89 SQL Injection BadSource: Property Read data from a system property GoodSource: A hardcoded string Sinks: prepareStatement GoodSink: Use prepared statement and execute (properly) BadSink : data concatenated into SQL statement used in prepareStatement() call, which could result in SQL ...

CWE: 89 SQL Injection BadSource: getQueryString_Servlet Parse id param out of the URL query string (without using getParameter()) GoodSource: A hardcoded string Sinks: prepareStatement GoodSink: Use prepared statement and execute (properly) BadSink : data concatenated into SQL statement used...

CWE: 89 SQL Injection BadSource: getQueryString_Servlet Parse id param out of the URL query string (without using getParameter()) GoodSource: A hardcoded string Sinks: execute GoodSink: Use prepared statement and execute (properly) BadSink : data concatenated into SQL statement used in execu...

CWE: 89 SQL Injection BadSource: PropertiesFile Read data from a .properties file (in property named data) GoodSource: A hardcoded string Sinks: executeUpdate GoodSink: Use prepared statement and executeUpdate (properly) BadSink : data concatenated into SQL statement used in executeUpdate(),...

CWE: 89 SQL Injection BadSource: PropertiesFile Read data from a .properties file (in property named data) GoodSource: A hardcoded string Sinks: executeQuery GoodSink: Use prepared statement and executeQuery (properly) BadSink : data concatenated into SQL statement used in executeQuery(), wh...

CWE: 89 SQL Injection BadSource: getParameter_Servlet Read data from a querystring using getParameter() GoodSource: A hardcoded string Sinks: executeQuery GoodSink: Use prepared statement and executeQuery (properly) BadSink : data concatenated into SQL statement used in executeQuery(), which...

CWE: 89 SQL Injection BadSource: console_readLine Read data from the console using readLine() GoodSource: A hardcoded string Sinks: executeQuery GoodSink: Use prepared statement and executeQuery (properly) BadSink : data concatenated into SQL statement used in executeQuery(), which could res...