보안약점 진단 #2

01 public void do(HttpServletRequest request, HttpServletResponse response) throws Throwable {
02     String data = "";
03     {
04         Connection connection = null;
05         PreparedStatement preparedStatement = null;
06         ResultSet resultSet = null;
07         try {
08             connection = IO.getDBConnection();
09             preparedStatement = connection.prepareStatement("select name from users where id=0");
10             resultSet = preparedStatement.executeQuery();
11             data = resultSet.getString(1);
12         } catch (SQLException exceptSql) {
13             IO.logger.log(Level.WARNING, "Error with SQL statement", exceptSql);
14         } finally {
15             try {
16                 if (resultSet != null) resultSet.close();
17             } catch (SQLException exceptSql) {
18                 IO.logger.log(Level.WARNING, "Error closing ResultSet", exceptSql);
19             }
20             try {
21                 if (preparedStatement != null) preparedStatement.close();
22             } catch (SQLException exceptSql) {
23                 IO.logger.log(Level.WARNING, "Error closing PreparedStatement", exceptSql);
24             }
25             try {
26                 if (connection != null) connection.close();
27             } catch (SQLException exceptSql) {
28                 IO.logger.log(Level.WARNING, "Error closing Connection", exceptSql);
29             }
30         }
31     }
32     if (data != null) {
33         response.getWriter().println("<br>data = " + data);
34     }
35 }