INNER CODE UNIT · Java

buildQuery

ron190/jsql-injection · model/src/main/java/com/jsql/model/InjectionModel.java:441

    private String buildQuery(AbstractMethodInjection methodInjection, String paramLead, boolean isUsingIndex, String sqlTrail) {
        String query;
        String paramLeadFixed = paramLead.replace(
            InjectionModel.STAR,
            TamperingUtil.TAG_OPENED + InjectionModel.STAR + TamperingUtil.TAG_CLOSED
        );
        if (
            // No parameter transformation if method is not selected by user
            this.mediatorUtils.connectionUtil().getMethodInjection() != methodInjection
            // No parameter transformation if injection point in URL
            || this.mediatorUtils.connectionUtil().getUrlBase().contains(InjectionModel.STAR)
        ) {
            query = paramLeadFixed;  // Just pass parameters without any transformation
        } else if (
            // If method is selected by user and URL does not contain injection point
            // but parameters contain an injection point
            // then replace injection point by SQL expression in this parameter
            paramLeadFixed.contains(InjectionModel.STAR)

View source record →