If user input is inserted without modification into an SQL query, then the application becomes vulnerable to SQL injection, like in the following example: $unsafe_variable = $_POST['user_input']; mysql_query("INSERT INTO `table` (`column`) VALUES ('$unsafe_variable')"); That’s because the user can input something ...
According To Java Docs: Thrown when an application attempts to use null in a case where an object is required. These include: Calling the instance method of a null object. Accessing or modifying the field of a null object. Taking the length of null as if it were an array. Accessing or modifying theRead more
According To Java Docs:
Thrown when an application attempts to use null in a case where an object is required. These include:
- Calling the instance method of a null object.
- Accessing or modifying the field of a null object.
- Taking the length of null as if it were an array.
- Accessing or modifying the slots of null as if it were an array.
- Throwing null as if it were a Throwable value.
Applications should throw instances of this class to indicate other illegal uses of the null object.
It is also the case that if you attempt to use a null reference with synchronized
, that will also throw this exception.
SynchronizedStatement:
synchronized ( Expression ) Block
Otherwise, if the value of the Expression is null, a NullPointerException
is thrown.
There are two overarching types of variables in Java:
- Primitives: variables that contain data. If you want to manipulate the data in a primitive variable you can manipulate that variable directly. By convention primitive types start with a lowercase letter. For example variables of type
int
orchar
are primitives. - References: variables that contain the memory address of an
Object
i.e. variables that refer to anObject
. If you want to manipulate theObject
that a reference variable refers to you must dereference it. Dereferencing usually entails using.
to access a method or field, or using[
to index an array. By convention reference types are usually denoted with a type that starts in uppercase. For example variables of typeObject
are references.
Consider the following code where you declare a variable of primitive type int
and don’t initialize it:
int x; int y = x + x;
These two lines will crash the program because no value is specified for x
and we are trying to use x
‘s value to specify y
. All primitives have to be initialized to a usable value before they are manipulated.
Now here is where things get interesting. Reference variables can be set to null
which means “I am referencing nothing“. You can get a null
value in a reference variable if you explicitly set it that way, or a reference variable is uninitialized and the compiler does not catch it (Java will automatically set the variable to null
).
If a reference variable is set to null either explicitly by you or through Java automatically, and you attempt to dereference it you get a NullPointerException
.
The NullPointerException
(NPE) typically occurs when you declare a variable but did not create an object and assign it to the variable before trying to use the contents of the variable. So you have a reference to something that does not actually exist.
Take the following code:
Integer num;
num = new Integer(10);
The first line declares a variable named num
, but it does not actually contain a reference value yet. Since you have not yet said what to point to, Java sets it to null
.
In the second line, the new
keyword is used to instantiate (or create) an object of type Integer
, and the reference variable num
is assigned to that Integer
object.
If you attempt to dereference num
before creating the object you get a NullPointerException
. In the most trivial cases, the compiler will catch the problem and let you know that “num may not have been initialized
,” but sometimes you may write code that does not directly create the object.
For instance, you may have a method as follows:
public void doSomething(SomeObject obj) {
// Do something to obj, assumes obj is not null
obj.myMethod();
}
In which case, you are not creating the object obj
, but rather assuming that it was created before the doSomething()
method was called. Note, it is possible to call the method like this:
doSomething(null);
In which case, obj
is null
, and the statement obj.myMethod()
will throw a NullPointerException
.
If the method is intended to do something to the passed-in object as the above method does, it is appropriate to throw the NullPointerException
because it’s a programmer error and the programmer will need that information for debugging purposes.
In addition to NullPointerException
s thrown as a result of the method’s logic, you can also check the method arguments for null
values and throw NPEs explicitly by adding something like the following near the beginning of a method:
// Throws an NPE with a custom error message if obj is null
Objects.requireNonNull(obj, "obj must not be null");
Note that it’s helpful to say in your error message clearly which object cannot be null
. The advantage of validating this is that 1) you can return your own clearer error messages and 2) for the rest of the method you know that unless obj
is reassigned, it is not null and can be dereferenced safely.
Alternatively, there may be cases where the purpose of the method is not solely to operate on the passed in object, and therefore a null parameter may be acceptable. In this case, you would need to check for a null parameter and behave differently. You should also explain this in the documentation. For example, doSomething()
could be written as:
public void doSomething(SomeObject obj) {
if(obj == null) {
// Do something
} else {
// Do something else
}
}
Now Java 14 has added a new language feature to show the root cause of NullPointerException. This language feature has been part of SAP commercial JVM since 2006.
In Java 14, the following is a sample NullPointerException Exception message:
in thread “main” java.lang.NullPointerException: Cannot invoke “java.util.List.size()” because “list” is null
List of situations that cause a NullPointerException
to occur
Here are all the situations in which a NullPointerException
occurs, that are directly* mentioned by the Java Language Specification:
- Accessing (i.e. getting or setting) an instance field of a null reference. (static fields don’t count!)
- Calling an instance method of a null reference. (static methods don’t count!)
throw null;
- Accessing elements of a null array.
- Synchronising on null –
synchronized (someNullReference) { ... }
- Any integer/floating point operator can throw a
NullPointerException
if one of its operands is a boxed null reference - An unboxing conversion throws a
NullPointerException
if the boxed value is null. - Calling
super
on a null reference throws aNullPointerException
. If you are confused, this is talking about qualified superclass constructor invocations:class Outer { class Inner {} } class ChildOfInner extends Outer.Inner { ChildOfInner(Outer o) { o.super(); // if o is null, NPE gets thrown } }
- Using a
for (element : iterable)
loop to loop through a null collection/array. switch (foo) { ... }
(whether its an expression or statement) can throw aNullPointerException
whenfoo
is null.foo.new SomeInnerClass()
throws aNullPointerException
whenfoo
is null.- Method references of the form
name1::name2
orprimaryExpression::name
throws aNullPointerException
when evaluated whenname1
orprimaryExpression
evaluates to null.
A note from the JLS here says that, someInstance.someStaticMethod()
doesn’t throw an NPE, because someStaticMethod
is static, but someInstance::someStaticMethod
still throw an NPE!
The correct way to avoid SQL injection attacks, no matter which database you use, is to separate the data from SQL, so that data stays data and will never be interpreted as commands by the SQL parser. It is possible to create an SQL statement with correctly formatted data parts, but if you don't fulRead more
The correct way to avoid SQL injection attacks, no matter which database you use, is to separate the data from SQL, so that data stays data and will never be interpreted as commands by the SQL parser. It is possible to create an SQL statement with correctly formatted data parts, but if you don’t fully understand the details, you should always use prepared statements and parameterized queries. These are SQL statements that are sent to and parsed by the database server separately from any parameters. This way it is impossible for an attacker to inject malicious SQL.
You basically have two options to achieve this:
Since PHP 8.2+ we can make use of
execute_query()
which prepares, binds parameters, and executes SQL statement in one method:Up to PHP8.1:
If you’re connecting to a database other than MySQL, there is a driver-specific second option that you can refer to (for example,
pg_prepare()
andpg_execute()
for PostgreSQL). PDO is the universal option.Correctly setting up the connection
PDO
Note that when using PDO to access a MySQL database real prepared statements are not used by default. To fix this you have to disable the emulation of prepared statements. An example of creating a connection using PDO is:
In the above example, the error mode isn’t strictly necessary, but it is advised to add it. This way PDO will inform you of all MySQL errors by means of throwing the
PDOException
.What is mandatory, however, is the first
setAttribute()
line, which tells PDO to disable emulated prepared statements and use real prepared statements. This makes sure the statement and the values aren’t parsed by PHP before sending it to the MySQL server (giving a possible attacker no chance to inject malicious SQL).Although you can set the
charset
in the options of the constructor, it’s important to note that ‘older’ versions of PHP (before 5.3.6) silently ignored the charset parameter in the DSN.Mysqli
For mysqli we have to follow the same routine:
Explanation
The SQL statement you pass to
prepare
is parsed and compiled by the database server. By specifying parameters (either a?
or a named parameter like:name
in the example above) you tell the database engine where you want to filter on. Then when you callexecute
, the prepared statement is combined with the parameter values you specify.The important thing here is that the parameter values are combined with the compiled statement, not an SQL string. SQL injection works by tricking the script into including malicious strings when it creates SQL to send to the database. So by sending the actual SQL separately from the parameters, you limit the risk of ending up with something you didn’t intend.
Any parameters you send when using a prepared statement will just be treated as strings (although the database engine may do some optimization so parameters may end up as numbers too, of course). In the example above, if the
$name
variable contains'Sarah'; DELETE FROM employees
the result would simply be a search for the string"'Sarah'; DELETE FROM employees"
, and you will not end up with an empty table.Another benefit of using prepared statements is that if you execute the same statement many times in the same session it will only be parsed and compiled once, giving you some speed gains.
Oh, and since you asked about how to do it for an insert, here’s an example (using PDO):
Can prepared statements be used for dynamic queries?
While you can still use prepared statements for the query parameters, the structure of the dynamic query itself cannot be parametrized and certain query features cannot be parametrized.
For these specific scenarios, the best thing to do is use a whitelist filter that restricts the possible values.