Zennoxa Shield
Rules / Java
SHIELD-JAVA-001

SQL Injection via String Concatenation

criticalJavaCWE-89CVSS 9.8

What it detects

SQL query built by concatenating input into a Statement execution call allows SQL injection.

How to fix

Use PreparedStatement with parameterized queries instead of concatenating input into SQL strings.

Vulnerable — Shield flags thisUserDao.java
import java.sql.*;

public class UserDao {
    public ResultSet findByUsername(Connection conn, String username) throws SQLException {
        Statement stmt = conn.createStatement();
        return stmt.executeQuery("SELECT id, email FROM users WHERE username = '" + username + "'");
    }
}
Fixed — scans cleanUserDao.java
import java.sql.*;

public class UserDao {
    public ResultSet findByUsername(Connection conn, String username) throws SQLException {
        PreparedStatement stmt = conn.prepareStatement("SELECT id, email FROM users WHERE username = ?");
        stmt.setString(1, username);
        return stmt.executeQuery();
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-001, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-001: SQL Injection via String Concatenation — Zennoxa Shield