Query returning sql string with wrong parameters

Question

I am currently working on fixing some SQL injection bugs in my project.

Here is my current sql string:

String sql = "select * from :table order by storenum";

Here is how I am setting the parameters:

SQLQuery query =  sess.createSQLQuery(sql).setParameter("table", table);

(table is a string that is passed in through a method)

Whenever I run the program I get something like this:

select * from ? order by storenum

Mureinik · Accepted Answer · 2021-12-22 17:30:15Z

2

You can't dynamically bind table names, only values, so you'll have to resort to string manipulation/concatenation to get the table name dynamically. However, you would probably want to escape it to avoid SQL Injections.

answered Dec 22, 2021 at 17:30

Mureinik

316k54 gold badges402 silver badges406 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Query returning sql string with wrong parameters

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related