SDey681610 (Community Member) asked a question.
What's causing a sql injection in the following code. It's a inner join query with 2 dynamic parameters.
sql="SELECT FO.UNIQUEID,FO.FLOORID,FO.NAME FROM FLOOROBJECT FO INNER JOIN DRY_LEVEL DL ON FO.PARENTID=DL.GUID_TX WHERE DL.PARENT_ID_TX=? AND UPPER(FO.TYPE)=?";
c=null;
try{
String args1[]={CachedInfo._lossId,"EQUIPMENT"};
DBHelper dh=DBInitializer.getDbHelper(); //DBHelper extends extends SQLiteOpenHelper
c=dh.getWritableDatabase().rawQuery(sql, args1);
}
catch(Exception e){}
.png){kind=logo}
Hi @SDey681610 (Community Member) ,
This may be related to what happens in 'getWritableDatabase()'. Unfortunately, without more information it is difficult to tell where the SQL injection is occurring.
I would recommend either scheduling a consultation ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/7YQTCDJKFEQzL3gL_N90hQ ) or creating a case with support by clicking your avatar in the top right corner of the Community and selecting "Contact Support".
In this please mention the Veracode Platform URL (starting with https://analysiscenter.veracode.com/) to your results as well as the flaw id.
Thank you,
Boy Baukema