title: Second order sql injection in java
body: <pre><code>public static boolean jdbcExecute(String query,Statement pstmt, String engineName){
       boolean res = false;
      int dbType = ServerProperty.getReference().getDBType(engineName);
      PreparedStatement pstmtNew = null;
       if(pstmt instanceof PreparedStatement){
              pstmtNew = (PreparedStatement)pstmt;
              res = pstmtNew.execute();    // Second order sql injection
          }else{
              res = pstmt.execute(WFSUtil.TO_STRING(query, false, dbType)); // No second order sql injection 
          }
         return res;
      }
  </code></pre>
  
  <p>Why second order sql injection is occuring at this place?</p>