java - How to prevent SQL injection In App Engine JDO -

please help..

how prevent sql injection @ time of jdo insertion?

my jdo class mydata.java

package com.jdo;  import java.util.date; import javax.jdo.annotations.persistencecapable; import javax.jdo.annotations.persistent; import javax.jdo.annotations.primarykey; import javax.jdo.annotations.identitytype;   @persistencecapable(identitytype = identitytype.application,detachable="true") public class mydata{     @primarykey     @persistent     private string id;      @persistent     private string name;      @persistent     private string address;       @persistent     private date addeddate;      /**      *       * @param id      * @param name      * @param address      */     public mydata(string id,string name,string address) {         super();         this.id=id;         this.name=name;         this.address=address;         this.addeddate = new date();     }       /**      * @return id      */     public string getid(){         return this.id;     }      /**      *       * @return name;      */     public string getname(){         return this.name;     }      /**      *       * @return addeddate      */     public date getaddeddate(){         return this.addeddate;     }       /**      *       * @param id      */     public void setid(string id){         this.id=id;     }      /**      *       * @param name      */     public void setname(string name){         this.name=name;     }      /**      *       * @param addeddate      */     public void setaddeddate(date addeddate){         this.addeddate=addeddate;     }   } 

and tried insert using

mydata user=new mydata ("id001","shana","address");                  user=mydatadao.savedata(user); 

it saving in table successfully..but need prevent sql injection...please help?

sql injection occurs when create queries concatenating strings of plain text strings of sql.

you don't need worry if

1. you're creating queries using prepared statements (which quote values under hood including untrusted ones), or
2. you're using orm creates queries plugging object fields prepared statement or careful escape data values when serializing messages datastore.

the code above looks falls category 2.