title: Cannot mitigate SQL Injections using OWASP.ESAPI - Veracode
body: <p>I am performing a veracode scan for my Java code and it throws following error in one of my DAO classes</p>
  
  <p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE ID 89 </p>
  
  <p>However, I tried to mitigate this using the OWASP.ESAPI Library as I cannot use paramterized input to structure my query as I am using String builders. The following is the sample code I'm trying to work on </p>
  
  <pre><code>private static String getPhoneDataSql(QuerySearchType type, PhoneQueryParams queryParams){      
      StringBuilder sql = new StringBuilder("select * from users where ");
      List&lt;String&gt; sqls = new ArrayList&lt;String&gt;();
  
      if(StringUtils.isNotBlank(queryParams.getUserId())){
          sqls.add("USER_ID like ".concat(type.format(encodeSQLInput(queryParams.getUserId()))));
      }
      if(StringUtils.isNotBlank(queryParams.getUserName())){
          sqls.add(UNAME_LIKE.concat(type.format(encodeSQLInput(queryParams.getUserName()))));
      }
      if(StringUtils.isNotBlank(queryParams.getCompany())){
          sqls.add("STR_COMPANY like ".concat(type.format(encodeSQLInput(queryParams.getCompany()))));
      }   
  
      boolean firstAnd = false;
      for(String s : sqls){
          sql.append(firstAnd ? STR_SQL_LIKE : "").append(s);
          firstAnd = true;
      }
      return sql.toString();
  }
  
  private static String encodeSQLInput(String sqlInput){  
      Codec ORACLE_CODEC = new OracleCodec();
      if(sqlInput == null) {
          return "NULL";
      }   
      sqlInput = ESAPI.encoder().encodeForSQL( ORACLE_CODEC, sqlInput);
      return sqlInput;
  }
  </code></pre>
  
  <p>Can somebody help?</p>