cwe-89-sql-injection

Replace unsafe SQL string concatenation with parameterized statements in Java.

3|1|Updated Mar 6, 2026

Search Tags:#sql injection #java #database security #jdbc #cwe-89 #preparedStatement

Ready to run

npx skills add https://github.com/DevelopersCoffee/java-cwe-security-skills --skill cwe-89-sql-injection

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cwe-89-sql-injection
Source: https://github.com/DevelopersCoffee/java-cwe-security-skills/tree/main
Command: npx skills add https://github.com/DevelopersCoffee/java-cwe-security-skills --skill cwe-89-sql-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires java.sql.PreparedStatement, org.springframework.jdbc.core.JdbcTemplate, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill protects your Java applications from SQL injection attacks, a common vulnerability that can lead to data breaches and unauthorized access.

Core Features & Use Cases

Detects vulnerable SQL queries: Identifies code where user input is directly concatenated into SQL statements.
Applies parameterized queries: Replaces vulnerable string concatenation with secure PreparedStatement or JdbcTemplate placeholders.
Use Case: Secure a web application's user login or data retrieval functions by ensuring all database queries are protected against malicious SQL input.

Quick Start

Use the cwe-89-sql-injection skill to secure the provided Java code against SQL injection.

Frequently Asked Questions about cwe-89-sql-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent SQL injection in Java applications using JDBC?▼

To prevent SQL injection in Java, replace unsafe string concatenation in SQL queries with parameterized statements using `PreparedStatement` or `JdbcTemplate`. This approach neutralizes malicious special elements in user input, ensuring database data integrity and preventing unauthorized access.

What is the best way to fix CWE-89 SQL injection vulnerabilities in Java code?▼

The best way to fix CWE-89 SQL injection vulnerabilities is to refactor Java code by replacing vulnerable string concatenation with secure parameterized queries. This ensures proper neutralization of special elements used in SQL commands, protecting against unauthorized database access.

Does JdbcTemplate support parameterized queries for database security?▼

Yes, JdbcTemplate supports parameterized queries for database security. It is a required dependency for this remediation process, allowing you to replace unsafe string concatenation with secure placeholders to prevent SQL injection attacks in Java applications.

How do I replace string concatenation with PreparedStatement to secure user login queries?▼

You secure user login queries by replacing direct string concatenation with `PreparedStatement` placeholders. This parameterized query mechanism neutralizes special elements in SQL commands, protecting web application data retrieval functions from malicious SQL input.

Why does string concatenation in SQL queries cause database security vulnerabilities?▼

String concatenation causes database security vulnerabilities because it directly inserts user input into SQL statements without neutralizing special elements. This improper handling allows attackers to inject malicious SQL commands, leading to unauthorized database access and data breaches.