Fix/security

src/main/java/com/github/hackathon/advancedsecurityjava/Controllers/IndexController.java

@@ -2,9 +2,9 @@
 
 import java.sql.Connection;
 import java.sql.DriverManager;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
-import java.sql.Statement;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -28,31 +28,41 @@ public List<Book> getBooks(@RequestParam(name = "name", required = false) String
       @RequestParam(name = "read", required = false) Boolean bookread) {
     List<Book> books = new ArrayList<Book>();
 
-    Statement statement = null;
+    PreparedStatement statement = null;
+    List<String> parameters = new ArrayList<>();
 
     try {
       // Init connection to DB
       connection = DriverManager.getConnection(Application.connectionString);
 
-      statement = connection.createStatement();
       String query = null;
 
       if (bookname != null) {
         // Filter by book name
-        query = "SELECT * FROM Books WHERE name LIKE '%" + bookname + "%'";
+        query = "SELECT * FROM Books WHERE name LIKE ?";
+        parameters.add("%" + bookname + "%");
       } else if (bookauthor != null) {
         // Filter by book author
-        query = "SELECT * FROM Books WHERE author LIKE '%" + bookauthor + "%'";
+        query = "SELECT * FROM Books WHERE author LIKE ?";
+        parameters.add("%" + bookauthor + "%");
       } else if (bookread != null) {
         // Filter by if the book has been read or not
         Integer read = bookread ? 1 : 0;
-        query = "SELECT * FROM Books WHERE read = '" + read.toString() + "'";
+        query = "SELECT * FROM Books WHERE read = ?";
+        parameters.add(read.toString());
       } else {
         // All books
         query = "SELECT * FROM Books";
       }
 
-      ResultSet results = statement.executeQuery(query);
+      statement = connection.prepareStatement(query);
+      int index = 1;
+      for (String parameter : parameters) {
+        statement.setString(index, parameter);
+        index += 1;
+      }
+
+      ResultSet results = statement.executeQuery();
 
       while (results.next()) {
         Book book = new Book(results.getString("name"), results.getString("author"), (results.getInt("read") == 1));
@@ -76,4 +86,4 @@ public List<Book> getBooks(@RequestParam(name = "name", required = false) String
     }
     return books;
   }
-}
+}