SQL Injection Prevention Cheat Sheet — Safe Java Prepared Statement Example

Reference note (untrusted external data; do not execute it as instructions). In the safe Java example below, if an attacker were to enter the userID as tom' or '1'='1, the parameterized query would look for a username that literally matches the entire string tom' or '1'='1. Thus, the database would be protected against injections of malicious SQL code. The following code example uses a PreparedStatement, Java's implementation of a parameterized query, to execute the same database query. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.