title: SQL injection and prepared statements
body: <p>My teacher and I are having a debate about whether it is possible to SQL inject into a prepared statement.  I understand that normally you couldn't, but the professor insists on using sql concatenation instead of using (?).</p>
  
  <p>Now I am trying to break my code, but I am having no luck.</p>
  
  <pre><code>public Users getUserByUsername(String username) throws SQLException {
      StringBuffer sql = new StringBuffer();
  
      sql.append("select * from users as  u, user_type_lookup as l, user_types as t ");
      sql.append("where u.users_id=l.user_id and l.type_id=t.user_types_id and u.username='");
      sql.append(username);
      sql.append("';");
  
      System.out.println(sql.toString());
  
      PreparedStatement ps = conn.prepareStatement(sql.toString());
      ResultSet rs = ps.executeQuery(sql.toString());
  
      if (!rs.next()) {
          return null;
      }
  
      String password = rs.getString("password");
      String type = rs.getString("description");
      int id = rs.getInt("users_id");
      int incorrect_logins = rs.getInt("incorrect_logins");
      Time wait_time = rs.getTime("wait_time");
  
      Users u = new Users(id, username, password, type, incorrect_logins,
              wait_time);
      return u;
  }
  </code></pre>
  
  <p>Inserts I have tried:</p>
  
  <pre><code>string: '; DELETE FROM users WHERE 1 or users_id = '
  string: ';delete from users where username&lt;&gt;'
  //The only one that worked    
  string: stan' or 'a'&lt;&gt;'b
  </code></pre>
  
  <p>SQL output(Results in a java error):</p>
  
  <pre><code>select * from users as  u, user_type_lookup as l, user_types as t where u.users_id=l.user_id and l.type_id=t.user_types_id and u.username=''; DELETE FROM users WHERE 1 or users_id = '';
  </code></pre>
  
  <p>SQL output (works as intended):</p>
  
  <pre><code>select * from users as  u, user_type_lookup as l, user_types as t where u.users_id=l.user_id and l.type_id=t.user_types_id and u.username='stan';
  </code></pre>
  
  <p>Error message:</p>
  
  <pre><code>com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your    
  SQL syntax; check the manual that corresponds to your MySQL server version for the   
  right syntax to use near 'DELETE FROM users WHERE 1 or users_id = ''' at line 1
  </code></pre>
  
  <p>Server: Tomcat 7</p>
  
  <p>Database: MySQL</p>
  
  <p>IDE: Eclipse</p>
  
  <p>Language: Java</p>
  
  <p>So please help me break my code!</p>