title: Java regular expression to prevent SQL injection
body: <p>During my burp suite test there are some SQL Injection vulnerabilities reported by the tool even after using prepared statement </p>
  
  <p>Eg :</p>
  
  <pre><code>SELECT address, state, status, plan, remarks, FROM archive  
  LEFT OUTER JOIN site_mappings ON site_dn = mrbts AND
  siteid = id where ((UPPER(technology) like 
  UPPER(?)))
  
   ps.setString(1, "%" +value+ "%");
  </code></pre>
  
  <p>Below are few SQL injection strings used by the tool</p>
  
  <pre><code>1. '%2b(select*from(select(sleep(20)))a)%2b'
  
  2. '
  
  3. "
  </code></pre>
  
  <p>I have filter function to white list the value and raise SQLException to prevent injection.</p>
  
  <pre><code>Pattern pattern = Pattern.compile("['\"*$]");
          Matcher matcher = pattern.matcher(value);
          if (matcher.find()) {
              throw new SQLException("Invalid filter value");
          }
  </code></pre>
  
  <p>It does not work for <code>'%2b(select*from(select(sleep(20)))a)%2b'</code> . </p>
  
  <p><strong>Issue detail :</strong></p>
  
  <p>The payload <code>'+(select*from(select(sleep(20)))a)+</code>' was submitted in the parameter. The application took 20011 milliseconds to respond to the request, compared with 24 milliseconds for the original request, indicating that the injected SQL command caused a time delay.</p>
  
  <p>How to create regular expression to prevent from SQL injection ?</p>