SQL injection in ORDER BY

Code reviewSecurityDatabases & SQLMid–Senior~22 min

Review this Java (JDBC) method that builds a dynamic listing query.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 22 min

Mark a line and say what kind of problem it is.0 findings

1List<Row> list(Connection c, String status, String orderBy, int limit) throws SQLException {

2 String sql = "SELECT id, title FROM issues WHERE status = ? "

3 + "ORDER BY " + orderBy + " LIMIT " + limit;

4 PreparedStatement ps = c.prepareStatement(sql);

5 ps.setString(1, status);

6 ResultSet rs = ps.executeQuery();

7 List<Row> out = new ArrayList<>();

8 while (rs.next()) out.add(new Row(rs.getLong(1), rs.getString(2)));

9 return out;

10}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.