3

I am trying to secure a web application, written in Java/JSP and running on PostgreSQL, against SQL injection. I ran into this very interesting answer, which refers to PHP and MySQL. Is there any resource on multibyte SQL injection against JSP/PostgreSQL? In particular, is PreparedStatement sufficient to protect the database?

Improve this question

1 Answer 1

Reset to default
1

Multibyte based SQL Injection is only an issue if mysql's encoding has been set to GBK. Your client and all of your tables should probably be in UTF-8 for compatibility or Latin1(seems to be the default in the USA). Multibyte character exploits are not a problem with these two encoding types.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .