Code reviewHardcr-g247

Subject Sql injectionLevel Senior–Staff~35 minCommon in Security · Databases & SQL interviewsIndustries Software development

Question

Review this Java reporting code. Assume `createUser` stores the display name via a parameterized insert.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix — specific and kind.

Learn the concepts

Talk through your review

Code to reviewjava

1// Stored earlier (safe, parameterized):2//   INSERT INTO users(id, display_name) VALUES (?, ?)3 4public List<Row> auditByUser(long userId, Connection conn) throws SQLException {5    PreparedStatement p = conn.prepareStatement("SELECT display_name FROM users WHERE id=?");6    p.setLong(1, userId);7    ResultSet rs = p.executeQuery();8    rs.next();9    String name = rs.getString("display_name");10    String sql = "SELECT * FROM audit_log WHERE actor = '" + name + "' ORDER BY ts DESC";11    return runRaw(conn, sql);  // executes the string directly12}

Run or narrate your approach, then ask the coach.