Posts

[JAVA] SQL Injection Preventive Code Example

Image
Wring ex ) sql.append("SELECT \n"); sql.append("  COUNT(*) CNT \n"); sql.append("FROM TABLE WHERE 1=1 AND COL " + type + " AND COL2 = '1' \n"); pstmt = conn.prepareStatement(sql); Rigth ex ) sql.append("SELECT \n"); sql.append("  COUNT(*) CNT \n"); sql.append("FROM TABLE WHERE 1=1 AND COL ? AND COL2 = '1' \n"); pstmt = conn.prepareStatement(sql); pstmt.setString(1, type); You must not use variables in conditional clauses use like this -> pstmt.setString(1, type);  this is same condition like when we use jdbcTemplate 😀 Thank you !! 고마워 !!

[JAVA] Type of parameter

Image
request.getParameter("param") : get parameter ( type : String ) request.getParameterValues("param") : get parameter ( type : String[] ) request.getParameterMap() : getting all of parameter  ( type : Map ) - key : param ( type : String ) - value : param values ( type : String[] ) request.getParameterNames() : getting all of parameter's name ( type : Enumeration ) 😀 Thank you !! 감사합니다 !!

[JAVA] System.out.print Simple input

Image
To quickly take System.out.print from Eclipse After entering it like this (Sys or sys, case-sensitive!!) Press Ctrl + space to display sysout on the right If you double-click this cool ~~ 😀 Thank you !! 고마워 !!

[JAVA] Improper Resource Releases

Image
  It's because we didn't finally release the resources It corresponds to a violation of the web vulnerability. ex) Connection conn = null; PreparedStatement pstmt = null; ResultSet rs = null; try { // conn , pstmt , rs code }catch(NullPointerException e){ finally{ if(rs!=null){rs.close();} if(pstmt!=null){pstmt.close();} if(conn!=null){conn.close();} } 😀 Thank you !! 감사합니다 !!

[JAVA] Error Message Information Disclosure

Image
Errors or error information should not be exposed to the console or on the screen. Use simple phrases only if necessary. Error information or system information should not be printed on the console or browser, but should be logged or printed in simple phrases if necessary Example of system data information disclosure (removal target code) Syste m.out.println(e.getMessage());, System.out.println(e);, e.printStackTrace();, out.println(e.getMessage()); Wrong ex) }catch(NullPointerException e){ System.out.println("Error : "+e); } } Right ex) }catch(NullPointerException e){ logger.error("ERROR-01 NullPointerException"); OR System.out.println("ERROR-01 NullPointerException"); } } 😀 Thank you !! 고마워 !!

[JAVA] Improper Exception Handling

Image
Throwable,Exception,RuntimeException must be that  It should not be widely held, but specific exceptions such as FileNotFoundException, SQLException, IOException, ClassNotFoundEXception, etc. should be handled  !! Wring ex) } catch(Exception e) { logger.error("ERROR-01 Exception"); } Right ex) } catch( SQLException e) { logger.error("ERROR-01 SQLException"); } 😀 Thank you!! 고마워!!

[JAVA] Creating a Star Pyramid

Image
class Star{ public static void main(String[] args){ for(int a=1; a<10; a=a+2){ // 1 3 5 7 9 for(int b=10; b>a; b=b-2){ // 10 8 6 4 2  System.out.print(" "); } for(int c=0; c<a; c=c+1){ // 0 1 2 3 4 5 6 7 8  System.out.print("*"); }     System.out.println(); } } } an) 😀 Thank you!! 고마워!!