Hi,
Lets say I have a login page using jsp or servlet. and this is the sql statement that will be used to query the database
String userName = request.getParameter("username");
String passWord = request.getParameter("password");
String sqlString = "SELECT * FROM UserTable WHERE USERNAME='" + userName
"' AND PASSWORD='" + passWord + "'";
What is a good approarch to prevent SQL injection attack?
I am thinking of using StringTokenizer to validate the sqlString up to the
4th single quote before being used on stmt.executeQuery(sqlString). Anything after the 4th single quote will be discarded.
Does anyone have any better ideas?