Code reviewMediumcr-g206

Subject InjectionLevel Mid–Senior~22 minCommon in Security · Databases & SQL interviewsIndustries Software development

Question

Review this Java (JDBC) method that builds a dynamic listing query.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjava

1List<Row> list(Connection c, String status, String orderBy, int limit) throws SQLException {2    String sql = "SELECT id, title FROM issues WHERE status = ? "3               + "ORDER BY " + orderBy + " LIMIT " + limit;4    PreparedStatement ps = c.prepareStatement(sql);5    ps.setString(1, status);6    ResultSet rs = ps.executeQuery();7    List<Row> out = new ArrayList<>();8    while (rs.next()) out.add(new Row(rs.getLong(1), rs.getString(2)));9    return out;10}

Run or narrate your approach, then ask the coach.