Here is the SQL query hard coded and used the prepared statment dynamically to set the parameters, and add batch. Finally execute the batch.

Batch SQL execution already constructed with parameter queries and SQL is hard coded and no chance of external input in alter the query.

However, Veracode shows this two lines as flaws.

try{

private final String addUser = "insert into users(id, organization_id, username, autocopy, enabled) values (%s,%1$s,?,?,?)";

PreparedStatement psAddUser psAddUser = myConn.prepareStatement(addUser);

for (final UserAndOrgID nu : usersToAdd) {

        final AegisUUID newidVal = AegisUUID.randomUUID();

        DatabaseUtilities.setValue(psAddUser, 1, newidVal);

        DatabaseUtilities.setValue(psAddUser, 2, nu.orgID);

        psAddUser.setString(3, nu.name);

        psAddUser.setNull(4, java.sql.Types.VARCHAR);

        psAddUser.setBoolean(5, false);

        psAddUser.setBoolean(6, true);

        psAddUser.addBatch();         

        psAddWorkspace.setString(3, "default");

        psAddWorkspace.addBatch();

      }

      psAddUser.executeBatch();

myConn.commit();

    } finally {

      DatabaseUtilities.close(psAddUser);

      DatabaseUtilities.close(psAddWorkspace);

      myConn.close();

    }

Please provide recommendation to fix this flaw, thanks in advance.