title: Java - Sanitizing user input in SQL Query
body: <p>We are scanning our Java project using <a href="https://checkmarx.com/" rel="nofollow noreferrer">Checkmarx</a> and it is flagging a violation under SQL Injection which says:</p>
  <blockquote>
  <p>The application's getClientConfigParameter method executes an SQL
  query with executeQuery, at line 56 of
  src/.../database/GSSGalaxyDBMain.java. The application constructs this
  SQL query by embedding an untrusted string into the query without
  proper sanitization. The concatenated string is submitted to the
  database, where it is parsed and executed accordingly. An attacker
  would be able to inject arbitrary syntax and data into the SQL query,
  by crafting a malicious payload and providing it via the input args;
  this input is then read by the main method at line 99 of
  src/gssgalaxy/ia/main/INStartApplication.java. This input then flows
  through the code, into a query and to the database server - without
  sanitization. This may enable an SQL Injection attack.</p>
  </blockquote>
  <p>for below code block</p>
  <pre class="lang-java prettyprint-override"><code>processid = dataloader.updateOnProcessTable(connection, prop.getProperty(&quot;ProcessTable&quot;));
  </code></pre>
  <p>where we are getting the property from properties file and not from the users directly. And when this process id is injected to the SQL statement it shows it as a violation. We doubt it to be a false positive as there is no raw input being directly passed from the user input. We are looking for the ways to get rid of this violation.</p>
  <p><strong>Edit - 1</strong>
  We have this prepared statemtent already in place, but for table names we are using something like this:</p>
  <pre><code>String query;
          String SQL_SELECT = &quot;SELECT PROCESS_ID FROM ${table}&quot;;
          query = SQL_SELECT.replaceAll(TABLE_REGEX, processTable);
  
          Statement stmt = (Statement) con.createStatement();
          rs = (ResultSet) stmt.executeQuery(query);
          while (rs.next()) {
              processId = rs.getInt(1);
          }
          processId++;
          String SQL_UPDATE = &quot;Update ${table} SET PROCESS_ID=?&quot;;
          query = SQL_UPDATE.replaceAll(TABLE_REGEX, processTable);
          PreparedStatement ps = null;
          con.setAutoCommit(false);
          ps = con.prepareStatement(query);
          ps.setInt(1, processId);
          ps.executeUpdate();
          con.commit();
  </code></pre>