Display name concatenated into SQL

Code reviewSecurityDatabases & SQLSenior–Staff~35 min

Review this Java reporting code. Assume `createUser` stores the display name via a parameterized insert.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 35 min

Mark a line and say what kind of problem it is.0 findings

1// Stored earlier (safe, parameterized):

2// INSERT INTO users(id, display_name) VALUES (?, ?)

4public List<Row> auditByUser(long userId, Connection conn) throws SQLException {

5 PreparedStatement p = conn.prepareStatement("SELECT display_name FROM users WHERE id=?");

6 p.setLong(1, userId);

7 ResultSet rs = p.executeQuery();

8 rs.next();

9 String name = rs.getString("display_name");

10 String sql = "SELECT * FROM audit_log WHERE actor = '" + name + "' ORDER BY ts DESC";

11 return runRaw(conn, sql); // executes the string directly

12}

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.