title: Apache Spark: In SparkSql, are sql's vulnerable to Sql Injection
body: <p>Scenario: </p>
  
  <p>Say there is a table in <strong>Hive</strong>, and it is queried using the below <strong>SparkSql in Apache Spark</strong>, where table name is passed as an argument and concatenated to the query.</p>
  
  <p>In case of non-distributed system, I have basic understanding of SQL-Injection vulnerability and in the context of JDBC understand the usage of createStatement/preparedStatement in the those kind of scenario.</p>
  
  <p>But what about this scenario in the case of sparksql, is this code vulnerable? Any insights ?</p>
  
  <pre><code>def main(args: Array[String]) {
  
      val sconf = new SparkConf().setAppName("TestApp")
      val sparkContext = new SparkContext(sconf)
      val hiveSqlContext = new org.apache.spark.sql.hive.HiveContext(sparkContext)
  
      val tableName = args(0)    // passed as an argument
  
      val tableData  =  hiveSqlContext.sql("select IdNUm, Name from hiveSchemaName." + tableName + " where IdNum &lt;&gt; '' ")
                                          .map( x =&gt; (x.getString(0), x.getString(1)) ).collectAsMap()
  
  
      ................
      ...............
  
  }
  </code></pre>