SQL Injection Attack Demonstration and Prevention in a Java Spring Application

SQL injection is a common attack where attackers manipulate user input to execute arbitrary SQL queries, exposing database data.

Example: a university course system with a course table; vulnerable controller code concatenates studentId directly into SQL, allowing injection.

Injection examples: using 4 or 1=1 to make the WHERE clause always true, retrieving all rows; using union select 1,1,version(),1 to obtain MySQL version; other UNION queries to list databases and tables.

To prevent injection, the article recommends using prepared statements with placeholders, e.g.,

String sql = "select id,course_id,student_id,status from course where student_id = ?";

and passing parameters via

jdbcTemplate.query(sql, new Object[]{studentId}, new BeanPropertyRowMapper(Course.class))

.

Additional defenses include type checking, length restrictions, strict database permissions, custom error handling, and filtering dangerous keywords via a servlet filter.