if (((String)value).endsWith("'"))
String stringValue = ((String)value).trim(); if (stringValue.startsWith(",") || stringValue.endsWith(",")) sawComma = true; if (stringValue.endsWith("'"))
	private void analyzeMethod(ClassContext classContext, Method method)			throws DataflowAnalysisException, CFGBuilderException {				JavaClass javaClass = classContext.getJavaClass();		MethodGen methodGen = classContext.getMethodGen(method);		if (methodGen == null) return;		ConstantPoolGen cpg = methodGen.getConstantPool();		try {		CFG cfg = classContext.getCFG(method);	        ConstantDataflow dataflow 			= classContext.getConstantDataflow(method);	    boolean sawOpenQuote = false;	    boolean sawCloseQuote = false;	    boolean sawAppend = false;	    	    for (Iterator<Location> i = cfg.locationIterator(); i.hasNext(); ) {				Location location = i.next();				Instruction ins = location.getHandle().getInstruction();				if (ins instanceof LDC) {					LDC load = (LDC) ins;					Object value = load.getValue(cpg);					if (value instanceof String) {						if (((String)value).endsWith("'"))							sawOpenQuote = true;						if (((String)value).startsWith("'"))							sawCloseQuote = true;					}				} else if (ins instanceof INVOKEVIRTUAL) {					INVOKEVIRTUAL invoke = (INVOKEVIRTUAL) ins;					if (invoke.getMethodName(cpg).equals("append")						&& invoke.getClassName(cpg).startsWith("java.lang.StringB")) {						sawAppend = true;					}				}	    }						for (Iterator<Location> i = cfg.locationIterator(); i.hasNext(); ) {			Location location = i.next();						Instruction ins = location.getHandle().getInstruction();			if (!(ins instanceof INVOKEINTERFACE)) continue;			INVOKEINTERFACE invoke = (INVOKEINTERFACE) ins;			String methodName = invoke.getMethodName(cpg);			String interfaceName = invoke.getClassName(cpg);			if (methodName.equals("prepareStatement") && interfaceName.equals("java.sql.Connection")					||  methodName.startsWith("execute") && interfaceName.equals("java.sql.Statement")) {			ConstantFrame frame = dataflow.getFactAtLocation(location);		        Constant value = frame.getStackValue(0);		    			if (!value.isConstantString()) {				int priority = LOW_PRIORITY;				if (sawAppend) priority--;				if (sawOpenQuote && sawCloseQuote) priority--;			    bugReporter.reportBug(				new BugInstance(this, 						methodName.equals("prepareStatement")						? "SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING" 								: "SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE",  				 priority) 				.addClassAndMethod(methodGen, javaClass.getSourceFileName())				.addSourceLine(classContext, methodGen, javaClass.getSourceFileName(), location.getHandle()));			}			}			}	} catch (RuntimeException e) {		System.out.println("Exception while checking for SQL injection in " 				+ methodGen + " in " + javaClass.getSourceFileName());		e.printStackTrace(System.out);		}				}