Contents

There are a lot of potential solutions against SQL injection. The prob-lem is that not all programmers use them, for various reasons. To check for bad code which can lead to SQL injection one could use JML speci-fication. The specification can be added to the code, or more favorable to the Java API. After the programmer has written a piece of code, you can check with a tool like ESC/Java2 if the code is vulnerable to SQL injection. Or you could use one of the other solutions I proposed to make sure that the programmer only uses ’safe ’ functions