src/main/java/com/findupon/commons/dao/core/JdbcFacade.java
/**
	 * Prevent basic invalid or unsupported (drop, etc.) and mass updates or deletes by enforcing parameters and relative
	 * clauses for each operation.
	 */
Prevent basic invalid or unsupported (drop, etc.) and mass updates or deletes by enforcing parameters and relative
clauses for each operation.
Prevent basic invalid or unsupported ( drop etc . ) and mass updates or deletes by enforcing parameters and relative clauses for each operation .
private boolean invalidSql(String sql) {
		if(StringUtils.isBlank(sql)) {
			logger.error("[JdbcFacade] - Missing SQL required for update operation");
			return true;
		}
		sql = sql.toLowerCase();
		if(!sql.contains("?")) {
			logger.error("[JdbcFacade] - SQL must be parameterized with '?'. Attempted: [{}]", sql);
			return true;
		}
		if(sql.contains("insert into ")) {
			if(!sql.contains("values") && !sql.contains("select")) {
				logger.error("[JdbcFacade] - Insert operation must contain 'values' or 'select'. Attempted: [{}]", sql);
				return true;
			}
			return false;
		}
		if(sql.contains("update ")) {
			if(!sql.contains("set ")) {
				logger.error("[JdbcFacade] - Update operation must contain 'set'. Attempted: [{}]", sql);
				return true;
			}
			if(!sql.contains("where ")) {
				logger.error("[JdbcFacade] - Update operation must contain a 'where' clause. Attempted: [{}]", sql);
				return true;
			}
			return false;
		}
		if(sql.contains("delete from ")) {
			if(!sql.contains("where ")) {
				logger.error("[JdbcFacade] - Delete operation must contain a 'where' clause. Attempted: [{}]", sql);
				return true;
			}
			return false;
		}
		if(sql.contains("select") && sql.contains("from ")) {
			if(!sql.contains("where ")) {
				logger.error("[JdbcFacade] - Select operation must contain a 'where' clause. Attempted: [{}]", sql);
				return true;
			}
			return false;
		}
		logger.error("[JdbcFacade] - SQL must be an insert, update, or delete operation. Attempted: [{}]", sql);
		return true;
	}
private boolean invalidSql ( String sql ) { if ( StringUtils . isBlank ( sql ) ) { logger . error ( "[JdbcFacade] - Missing SQL required for update operation" ) ; return true ; } sql = sql . toLowerCase ( ) ; if ( ! sql . contains ( "?" ) ) { logger . error ( "[JdbcFacade] - SQL must be parameterized with '?'. Attempted: [{}]" , sql ) ; return true ; } if ( sql . contains ( "insert into " ) ) { if ( ! sql . contains ( "values" ) && ! sql . contains ( "select" ) ) { logger . error ( "[JdbcFacade] - Insert operation must contain 'values' or 'select'. Attempted: [{}]" , sql ) ; return true ; } return false ; } if ( sql . contains ( "update " ) ) { if ( ! sql . contains ( "set " ) ) { logger . error ( "[JdbcFacade] - Update operation must contain 'set'. Attempted: [{}]" , sql ) ; return true ; } if ( ! sql . contains ( "where " ) ) { logger . error ( "[JdbcFacade] - Update operation must contain a 'where' clause. Attempted: [{}]" , sql ) ; return true ; } return false ; } if ( sql . contains ( "delete from " ) ) { if ( ! sql . contains ( "where " ) ) { logger . error ( "[JdbcFacade] - Delete operation must contain a 'where' clause. Attempted: [{}]" , sql ) ; return true ; } return false ; } if ( sql . contains ( "select" ) && sql . contains ( "from " ) ) { if ( ! sql . contains ( "where " ) ) { logger . error ( "[JdbcFacade] - Select operation must contain a 'where' clause. Attempted: [{}]" , sql ) ; return true ; } return false ; } logger . error ( "[JdbcFacade] - SQL must be an insert, update, or delete operation. Attempted: [{}]" , sql ) ; return true ; }
Prevent basic invalid or unsupported (drop, etc.)
Prevent basic invalid or unsupported ( drop etc . )