title: Blacklist filtering data for SQL Keywords
body: <p>I am trying to validate data before inserting them into the database(POSTGRESQL). The data corresponding to email, zip code etc are easily validated with the use of Apache Commons Validator. But in case of names I used this:</p>
  
  <pre><code>^[a-zA-Z][ a-zA-Z]{1-30}$
  </code></pre>
  
  <p>This prevents any special characters from being added as name, but it fails to prevent users from adding <code>DROP or GRANT</code> as a name. As I am using <code>PreparedStatement</code>, I didn't think it was going to be a problem but it is now required that SQL keywords shouldn't go in the db as it may lead to a <em>Second Order SQL Injection.</em></p>
  
  <p>I thought of using blacklisting all SQL keywords (surely, this will prevent Huge Grant from logging into our site. :P) but it seems that there are >64 keywords. Is this <strong>(Blacklist filtering data for SQL Keywords)</strong> a proper approach for <strong>preventing Second Order SQL Injection</strong>? What are my options?</p>
  
  <p>I am using this code:</p>
  
  <pre><code>String sql="INSERT INTO users (username, password, name) VALUES (?,?,?);";
          try{
              conn=SomeStaticClass.createConnection();
              ps=conn.prepareStatement(sql);
              ps.setString(1, dataBean.getUsername());
              ps.setString(2, dataBean.getPassword());
              ps.setString(3, dataBean.getName());
              ps.execute();
          }catch(SQLException e){
              e.printStackTrace()
          }catch(Exception e){
              e.printStackTrace();
          }finally{
              try{
                  if(ps!=null){
                      ps.close();
                  }
                  conn.close();
              }catch(SQLException e){
                  e.printStackTrace();
              }
          }
  </code></pre>