We have some doubt on recent reports that clues CWE 89 SQL Injections flaws exist in some of our classes, even though we have used prepared statements, for example:

public static void createUser(String userName, String password, String tags) {

try {

byte[] salt = generateSalt();

byte[] bpass = getEncryptedPassword(password, salt);

String secuSchema = DSManager.getSecuSchema();

String strDS = DSManager.getSecuDS();

String sql = "INSERT into " + secuSchema + ".SEC_USER_TOKEN VALUES (?,?,?,?)";

try (Connection con = QueryUtil.getConnection(strDS); 

PreparedStatement ps = con.prepareStatement(sql)) {

ps.setString(1, userName);

ps.setBytes(2, bpass);

ps.setBytes(3, salt);

ps.setString(4, tags);

ps.execute(); //here is a flaw ?

} catch (NamingException | SQLException e) {

APLogExec.writeEEError(DataType.getErrorStackTrace(e));

}

}catch(Exception e) {

APLogExec.writeEEError(DataType.getErrorStackTrace(e));

}

And:

public boolean deleteRec(String dataSource, String sql, Object[] parameters) throws Exception {

Connection con = null;

try {

con = DSManager.getConnection(dataSource);

int ret = this.update(con, sql, parameters); // here is a flaw ?

return ret > 0;

} finally {

DbUtils.close(con);

}

}

}

this.update is extended from apache QueryRunner:

/**

   * Calls update after checking the parameters to ensure nothing is null.

   * @param conn The connection to use for the update call.

   * @param closeConn True if the connection should be closed, false otherwise.

   * @param sql The SQL statement to execute.

   * @param params An array of update replacement parameters. Each row in

   * this array is one set of update replacement values.

   * @return The number of rows updated.

   * @throws SQLException If there are database or parameter errors.

   */

  private int update(Connection conn, boolean closeConn, String sql, Object... params) throws SQLException {

    if (conn == null) {

      throw new SQLException("Null connection");

    }

    if (sql == null) {

      if (closeConn) {

        close(conn);

      }

      throw new SQLException("Null SQL statement");

    }

    PreparedStatement stmt = null;

    int rows = 0;

    try {

      stmt = this.prepareStatement(conn, sql);

      this.fillStatement(stmt, params);

      rows = stmt.executeUpdate();

    } catch (SQLException e) {

      this.rethrow(e, sql, params);

    } finally {

      close(stmt);

      if (closeConn) {

        close(conn);

      }

    }

    return rows;

  }

Why and How to fix these? Thanks