title: Java SQL Injection - MySQLSyntaxErrorException
body: <p>I am attempting to SQL inject one of my applications for a write up that I need to do for a project.</p>
  
  <p>I have used the following statement:</p>
  
  <pre><code>Statement statement = conn.createStatement();
  String insertTableSQL = "INSERT INTO activity (activity_name, user_id, category_id, started, completed) VALUES ('" + activityForm.getName() + "', '" + user.getId() + "', '" + category.getId() + "', '" + 0 + "', '" + 0 + "')";
  System.out.println(insertTableSQL);
  statement.executeUpdate(insertTableSQL);
  </code></pre>
  
  <p>When I then put the following into one of my form inputs (in this case the activity name input):</p>
  
  <blockquote>
    <p>ActivityName'); DROP TABLE STUDENTS; --</p>
  </blockquote>
  
  <p>I get the following error:</p>
  
  <pre><code>INSERT INTO activity (activity_name, patient_id, category_id, started, completed) VALUES ('ActivityName'); DROP TABLE STUDENTS; --', '1', '1', '0', '0')
  com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DROP TABLE STUDENTS; --', '1', '1', '0', '0')' at line 1
  </code></pre>
  
  <p>I cannot seem to find a way to avoid this error so I hope someone has some ideas.</p>
  
  <p>I am guessing the error is occuring because of the way Statement in java works and the rest of the query being parsed.</p>
  
  <p>Thanks</p>
  
  <p><strong>EDIT: I know that I should use prepared statements, I do. My application uses ORM with JPA. 
  For university, I am just testing how SQL injection works.</strong></p>