How to avoid "Security - A prepared statement is generated from a nonconstant String" FindBugs Warning

java jdbc findbugs
ederribeiro picture ederribeiro · May 8, 2012 · Viewed 19.9k times · Source

I am working on a project that has a piece of code like the one below:

String sql = "SELECT MAX(" + columnName + ") FROM " + tableName;                
PreparedStatement ps = connection.prepareStatement(sql);

Is there any way that I can change this code so that FindBugs stop giving me a "Security - A prepared statement is generated from a nonconstant String" warning ?

Please assume that this code is safe regarding SQL INJECTION since I can control elsewhere in the code the possible values for "tableName" and "columnName" (they do not come come directly from user input).

Answer

Ashish Dadhore picture Ashish Dadhore · Oct 8, 2013 
private static final String SQL = "SELECT MAX(?) FROM ?";
PreparedStatement ps = connection.prepareStatement(sql);
ps.preparedStatement.setInt(1,columnName);
ps.preparedStatement.setString(2,tableName);

if you are using prepared statement, then in parameter should be a final string and parameters should be added later using setInt, setString methods.

this will resolve the findbug warning.

Related questions

ResultSet not closed when connection closed?

I've been doing code review (mostly using tools like FindBugs) of one of our pet projects and FindBugs marked following code as erroneous (pseudocode): Connection conn = dataSource.getConnection(); try{ PreparedStatement stmt = conn.prepareStatement(); //initialize the statement stmt.execute(); ResultSet rs = …

Read More
Solving a "communications link failure" with JDBC and MySQL

I'm trying to connect to the local MySQL server but I keep getting an error. Here is the code. public class Connect { public static void main(String[] args) { Connection conn = null; try { String userName = "myUsername"; String password = "myPassword"; String url = "…

Read More
com.mysql.jdbc.exceptions.jdbc4.CommunicationsException: Communications link failure

I'm working on getting my database to talk to my Java programs. Can someone give me a quick and dirty sample program using the JDBC? I'm getting a rather stupendous error: Exception in thread "main" com.mysql.jdbc.exceptions.jdbc4.…

Read More