title: zap tool showing security vulnerability but we can't find those vulnerability in our source code?
body: <p>vulnerability showing as:-</p>
  
  <ol>
  <li>SQL Injection - SQLite</li>
  </ol>
  
  <p><strong>Method:</strong> GET</p>
  
  <p><strong>Parameter:</strong> query</p>
  
  <p><strong>Attack:</strong> ' | case randomblob(10000000) when not null then "" else "" end --</p>
  
  <p><strong>Evidence:</strong> The query time is controllable using parameter value [' | case randomblob(10000000) when not null then "" else "" end --], which caused the request to take [542] milliseconds, parameter value [' | case randomblob(100000000) when not null then "" else "" end --], which caused the request to take [900] milliseconds, when the original unmodified query with value [query] took [167] milliseconds.</p>
  
  <ol start="2">
  <li>SQL Injection - Oracle - Time Based</li>
  </ol>
  
  <p><strong>Method:</strong> GET</p>
  
  <p><strong>Parameter:</strong> query</p>
  
  <p><strong>Attack:</strong> field: [query], value [query and exists (SELECT UTL_INADDR.get_host_name('10.0.0.1') from dual union SELECT UTL_INADDR.get_host_name('10.0.0.2') from dual union SELECT UTL_INADDR.get_host_name('10.0.0.3') from dual union SELECT UTL_INADDR.get_host_name('10.0.0.4') from dual union SELECT UTL_INADDR.get_host_name('10.0.0.5') from dual) -- ]</p>
  
  <ol start="3">
  <li>Advanced SQL Injection - Oracle AND time-based blind</li>
  </ol>
  
  <p><strong>Method:</strong> GET</p>
  
  <p><strong>Parameter:</strong> query</p>
  
  <p><strong>Attack:</strong> query AND 2972=DBMS_PIPE.RECEIVE_MESSAGE(CHR(113)||CHR(65)||CHR(80)||CHR(114),5)</p>
  
  <ol start="4">
  <li>SQL Injection - MsSQL</li>
  </ol>
  
  <p><strong>Method:</strong> GET</p>
  
  <p><strong>Parameter:</strong> query</p>
  
  <p><strong>Attack:</strong> query WAITFOR DELAY '0:0:15' --</p>
  
  <ol start="5">
  <li>SQL Injection - Hypersonic SQL - Time Based</li>
  </ol>
  
  <p><strong>Method:</strong> GET</p>
  
  <p><strong>Parameter:</strong> query</p>
  
  <p><strong>Attack:</strong> field: [query], value ["; select "java.lang.Thread.sleep"(15000) from INFORMATION_SCHEMA.SYSTEM_COLUMNS where TABLE_NAME = 'SYSTEM_COLUMNS' and COLUMN_NAME = 'TABLE_NAME' -- ]</p>
  
  <ol start="6">
  <li>SQL Injection - PostgreSQL - Time Based</li>
  </ol>
  
  <p><strong>Method:</strong> GET</p>
  
  <p><strong>Parameter:</strong> query</p>
  
  <p><strong>Attack:</strong> field: [query], value [case when cast(pg_sleep(15) as varchar) > '' then 0 else 1 end]</p>
  
  <ol start="7">
  <li>SQL Injection - MySQL</li>
  </ol>
  
  <p><strong>Method:</strong> GET</p>
  
  <p><strong>Parameter:</strong> query</p>
  
  <p><strong>Attack:</strong> query / sleep(15)</p>
  
  <ol start="8">
  <li>Advanced SQL Injection - PostgreSQL > 8.1 stacked queries (comment)</li>
  </ol>
  
  <p><strong>Method:</strong> GET</p>
  
  <p><strong>Parameter:</strong> query</p>
  
  <p><strong>Attack:</strong> query;SELECT PG_SLEEP(5)--</p>
  
  <ol start="9">
  <li>Advanced SQL Injection - Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)</li>
  </ol>
  
  <p><strong>Method:</strong> GET</p>
  
  <p><strong>Parameter:</strong> query</p>
  
  <p><strong>Attack:</strong> Feb 2018;SELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(105)||CHR(122)||CHR(102)||CHR(108),5) FROM DUAL--</p>
  
  <ol start="10">
  <li>Advanced SQL Injection - Microsoft SQL Server/Sybase time-based blind.</li>
  </ol>
  
  <p><strong>Method:</strong> GET</p>
  
  <p><strong>Parameter:</strong> query</p>
  
  <p><strong>Attack:</strong> query) WAITFOR DELAY CHAR(48)+CHAR(58)+CHAR(48)+CHAR(58)+CHAR(91)+CHAR(83)+CHAR(76)+CHAR(69)+CHAR(69)+CHAR(80)+CHAR(84)+CHAR(73)+CHAR(77)+CHAR(69)+CHAR(93) AND (1972=1972</p>
  
  <p>All of our source code following the given Example:-</p>
  
  <p><code>public interface UserRepository extends JpaRepository&lt;User, Long&gt; {
          @Query("select u from User u where u.firstname = :firstname or u.lastname = :lastname")
          User findByLastnameOrFirstname(@Param("lastname") String lastname, 
                               @Param("firstname") String firstname);
  }</code></p>