SQL Injection and Parameter Binding in Hibernate

<div dir&equals;"ltr" style&equals;"text-align&colon; justify&semi;">&NewLine;<div dir&equals;"ltr" style&equals;"text-align&colon; justify&semi;">&NewLine;<div dir&equals;"ltr" style&equals;"text-align&colon; justify&semi;">&NewLine;<div dir&equals;"ltr" style&equals;"text-align&colon; justify&semi;">&NewLine;<div dir&equals;"ltr" style&equals;"text-align&colon; justify&semi;">&NewLine;<div dir&equals;"ltr" style&equals;"text-align&colon; justify&semi;">&NewLine;<div dir&equals;"ltr" style&equals;"text-align&colon; justify&semi;">&NewLine;<div dir&equals;"ltr" style&equals;"text-align&colon; justify&semi;">&NewLine;<div dir&equals;"ltr" style&equals;"text-align&colon; justify&semi;">&NewLine;<div dir&equals;"ltr" style&equals;"color&colon; &num;20124d&semi; text-align&colon; left&semi;">&NewLine;<p>In this tutorial of SQL Injection and Parameter Binding in Hibernate we will discuss about SQL inject and its demerits and also describe Parameter binding&comma; it means is way to bind parameter with SQL to use in the hibernate for particular criteria&period;<&sol;p>&NewLine;<h2>SQL Injection&colon;<&sol;h2>&NewLine;<&sol;div>&NewLine;<div style&equals;"color&colon; &num;20124d&semi;">Injecting the value to the SQL statement&period; SQL injection refers to the act of someone inserting a MySQL statement to be run on your database without your knowledge&period; Injection usually occurs when you ask a user for input&comma; like their name&comma; and instead of a name they give you a MySQL statement that you will unknowingly run on your database&period;<&sol;div>&NewLine;<h2 class&equals;"specialT" style&equals;"color&colon; &num;20124d&semi;"><&sol;h2>&NewLine;<div class&equals;"display" style&equals;"color&colon; &num;20124d&semi;"><b>Normal&colon;<&sol;b>    &&num;8221&semi; SELECT &ast; FROM student WHERE studentName&equals; &&num;8216&semi;sweety'&&num;8221&semi;<br &sol;>&NewLine;<b>Injection&colon;<&sol;b>  &&num;8220&semi;SELECT &ast; FROM student WHERE studentName&equals; &&num;8221&semi; &plus;studentName<&sol;div>&NewLine;<div style&equals;"color&colon; &num;20124d&semi;">&NewLine;<div style&equals;"color&colon; &num;20124d&semi;"><&sol;div>&NewLine;<p>It is a very common misconception that ORM solutions&comma; like hibernate&comma; are SQL Injection proof&period; Hibernate allows the use of &&num;8220&semi;native SQL&&num;8221&semi; and defines a proprietary query language&comma; named&comma; HQL the former is prone to SQL Injection and the later is prone to HQL injection&period;<&sol;p>&NewLine;<p>&nbsp&semi;<&sol;p>&NewLine;<div class&equals;"separator" style&equals;"clear&colon; both&semi; text-align&colon; center&semi;"><img src&equals;"https&colon;&sol;&sol;dineshonjava&period;com&sol;wp-content&sol;uploads&sol;2017&sol;04&sol;sql-injection-and-entity-frameworks&period;jpg" border&equals;"0" &sol;><&sol;div>&NewLine;<p><b><i>&commat;ImageSource-Slideshare&period;net<&sol;i><&sol;b><&sol;p>&NewLine;<h2 style&equals;"color&colon; &num;20124d&semi;">Parameter Binding&colon;<&sol;h2>&NewLine;<&sol;div>&NewLine;<&sol;div>&NewLine;<div style&equals;"color&colon; &num;20124d&semi;">A bind variable is a named placeholder &lpar;preceded by a colon&rpar; that is embedded in the query string in place of a literal&period; The actual value is substituted at runtime using the setParameter&lpar;&rpar; method&period;<&sol;div>&NewLine;<p>Without parameter binding&comma; you have to concatenate the parameter String like this &lpar;bad code&rpar; &colon;<&sol;p>&NewLine;<&sol;div>&NewLine;<pre class&equals;"highlight">String hql &equals; "from Student student where student&period;studentName &equals; '" &plus; studentName&plus; "'"&semi; &NewLine;Query query &equals; session&period;createQuery&lpar;hql&rpar;&semi; &NewLine;List result &equals; query&period;list&lpar;&rpar;&semi; &NewLine;<&sol;pre>&NewLine;<&sol;div>&NewLine;<p>&nbsp&semi;<&sol;p>&NewLine;<div style&equals;"color&colon; &num;20124d&semi;">Pass an unchecked value from user input to the database will raise security concern&comma; because it can easy get hack by SQL injection&period; You have to avoid the above bad code and using parameter binding instead&period;<&sol;div>&NewLine;<h3 style&equals;"color&colon; &num;20124d&semi;">Hibernate parameter binding<&sol;h3>&NewLine;<div style&equals;"color&colon; &num;20124d&semi;">There are two ways to parameter binding &colon;<&sol;div>&NewLine;<ol style&equals;"color&colon; &num;20124d&semi; text-align&colon; left&semi;">&NewLine;<li>Named parameters binding<&sol;li>&NewLine;<li>Positional parameters binding&period;<&sol;li>&NewLine;<&sol;ol>&NewLine;<div style&equals;"color&colon; &num;20124d&semi;"> <b>1&period; Named Parameters Binding&colon; <&sol;b><&sol;div>&NewLine;<div style&equals;"color&colon; &num;20124d&semi;">This is the most common and user friendly way&period; It use colon followed by a parameter name<b> &lpar;&colon;example&rpar;<&sol;b> to define a named parameter&period; See examples…<b> <&sol;b><&sol;div>&NewLine;<h5 style&equals;"color&colon; &num;20124d&semi; font-weight&colon; normal&semi;"><b>Example 1 – setParameter<&sol;b><&sol;h5>&NewLine;<div style&equals;"color&colon; &num;20124d&semi;">The <b>setParameter<&sol;b> is smart enough to discover the parameter data type for you&period;<&sol;div>&NewLine;<&sol;div>&NewLine;<pre class&equals;"highlight">String hql &equals; "from Student student where student&period;rollNumber&equals; &colon;rollNumber"&semi; &NewLine;Query query &equals; session&period;createQuery&lpar;hql&rpar;&semi; &NewLine;query&period;setParameter&lpar;"rollNumber"&comma; "3"&rpar;&semi; &NewLine;List result &equals; query&period;list&lpar;&rpar;&semi;<&sol;pre>&NewLine;<&sol;div>&NewLine;<p>&nbsp&semi;<&sol;p>&NewLine;<h5>Example 2 – setString<&sol;h5>&NewLine;<p>You can use <b>setString<&sol;b> to tell Hibernate this parameter date type is String&period;<&sol;p>&NewLine;<&sol;div>&NewLine;<pre class&equals;"highlight">String hql &equals; "from Student student where student&period;studentName&equals; &colon;studentName"&semi; &NewLine;Query query &equals; session&period;createQuery&lpar;hql&rpar;&semi; &NewLine;query&period;setString&lpar;"studentName"&comma; "Sweety Rajput"&rpar;&semi; &NewLine;List result &equals; query&period;list&lpar;&rpar;&semi; &NewLine;<&sol;pre>&NewLine;<h5 style&equals;"color&colon; &num;20124d&semi;">Example 3 – setProperties<&sol;h5>&NewLine;<div style&equals;"color&colon; &num;20124d&semi;">This feature is great &excl; You can pass an object into the parameter binding&period; Hibernate will automatic check the object’s properties and match with the colon parameter&period;<&sol;div>&NewLine;<&sol;div>&NewLine;<pre class&equals;"highlight">Student student&equals; new Student&lpar;&rpar;&semi; &NewLine;student&period;setCourse&lpar;"MCA"&rpar;&semi; &NewLine;String hql &equals; "from Student student where student&period;course&equals; &colon;course"&semi; &NewLine;Query query &equals; session&period;createQuery&lpar;hql&rpar;&semi; &NewLine;query &period;setProperties&lpar;student&rpar;&semi; &NewLine;List result &equals; query&period;list&lpar;&rpar;&semi; &NewLine;<&sol;pre>&NewLine;<h4 style&equals;"color&colon; &num;20124d&semi;">2&period; Positional parameters<&sol;h4>&NewLine;<div style&equals;"color&colon; &num;20124d&semi;">It’s use question mark &lpar;&quest;&rpar; to define a named parameter&comma; and you have to set your parameter according to the position sequence&period; See example…<&sol;div>&NewLine;<&sol;div>&NewLine;<pre class&equals;"highlight">String hql &equals; "from Student student where student&period;course&equals; &quest; and student&period;studentName &equals; &quest;"&semi; &NewLine;Query query &equals; session&period;createQuery&lpar;hql&rpar;&semi; &NewLine;query&period;setString&lpar;0&comma; "MCA"&rpar;&semi; &NewLine;query&period;setParameter&lpar;1&comma; "Dinesh Rajput"&rpar; &NewLine;List result &equals; query&period;list&lpar;&rpar;&semi; &NewLine;<&sol;pre>&NewLine;<div>&NewLine;<div style&equals;"color&colon; &num;073763&semi;">In Hibernate parameter binding&comma; i would recommend always go for &&num;8220&semi;Named parameters&&num;8221&semi;&comma; as it’s more easy to maintain&comma; and the compiled SQL statement can be reuse &lpar;if only bind parameters change&rpar; to increase the performance&period;<&sol;div>&NewLine;<div style&equals;"color&colon; &num;073763&semi;"><&sol;div>&NewLine;<div style&equals;"color&colon; &num;073763&semi;"><&sol;div>&NewLine;<div style&equals;"color&colon; &num;073763&semi;"><b>In the <a href&equals;"https&colon;&sol;&sol;dineshonjava&period;com&sol;p&sol;named-queries&period;html">Next Chapter<&sol;a> we will discuss about the <a href&equals;"https&colon;&sol;&sol;dineshonjava&period;com&sol;p&sol;named-queries&period;html">Named Query<&sol;a>&period;<&sol;b><&sol;div>&NewLine;<div style&equals;"color&colon; &num;073763&semi;"><b> <&sol;b><&sol;div>&NewLine;<div style&equals;"color&colon; &num;073763&semi;"><b>            <&sol;b><&sol;div>&NewLine;<div style&equals;"color&colon; &num;073763&semi;"><b> <&sol;b><&sol;div>&NewLine;<p><b>   &lt&semi;&lt&semi;<a style&equals;"color&colon; &num;073763&semi; font-family&colon; Times&comma; 'Times New Roman'&comma; serif&semi; font-size&colon; x-large&semi; line-height&colon; 14px&semi;" href&equals;"https&colon;&sol;&sol;dineshonjava&period;com&sol;p&sol;select-and-pagination-in-hql&period;html">Previous Chapter 27<&sol;a>&lt&semi;&lt&semi;    &gt&semi;&gt&semi;N<a style&equals;"color&colon; &num;073763&semi; font-size&colon; x-large&semi; line-height&colon; 14px&semi;" href&equals;"https&colon;&sol;&sol;dineshonjava&period;com&sol;p&sol;named-queries&period;html">ext Chapter 29<&sol;a>&gt&semi;&gt&semi;<&sol;b><&sol;p>&NewLine;<div style&equals;"color&colon; &num;073763&semi;"><&sol;div>&NewLine;<div style&equals;"color&colon; &num;073763&semi;"><&sol;div>&NewLine;<div style&equals;"color&colon; &num;073763&semi;"><&sol;div>&NewLine;<div style&equals;"color&colon; &num;073763&semi;"><&sol;div>&NewLine;<div style&equals;"color&colon; &num;073763&semi;"><&sol;div>&NewLine;<&sol;div>&NewLine;<&sol;div>&NewLine;

View Comments