보안약점 진단 #4

01 public void do() throws Throwable {
02     String data = System.getenv("ADD");
03     if (data != null) {
04         String names[] = data.split("-");
05         int successCount = 0;
06         Connection dbConnection = null;
07         Statement stmt = null;
08         try {
09             dbConnection = IO.getDBConnection();
10             stmt = dbConnection.createStatement();
11             for (int i = 0; i < names.length; i++) {
12                 stmt.addBatch("update users set hitcount=hitcount+1 where name='" + names[i] + "'");
13             }
14             int resultsArray[] = stmt.executeBatch();
15             for (int i = 0; i < names.length; i++) {
16                 if (resultsArray[i] > 0) successCount++;
17             }
18             IO.writeLine("Succeeded in " + successCount + " out of " + names.length + " queries.");
19         } catch (SQLException exceptSql) {
20             IO.logger.log(Level.WARNING, "Error getting database connection", exceptSql);
21         }
21          finally {
22             try {
23                 if (stmt != null) stmt.close();
24             } catch (SQLException exceptSql) {
25                 IO.logger.log(Level.WARNING, "Error closing Statament", exceptSql);
26             }
27             try {
28                 if (dbConnection != null) dbConnection.close();
29             } catch (SQLException exceptSql) {
30                 IO.logger.log(Level.WARNING, "Error closing Connection", exceptSql);
31             }
32         }
33     }
34 }