Android 如何处理/避免Sqlite数据库中的SQL注入

我写了一个EmployeeDao类，所有功能都很好，但我从客户端SQL注入攻击中遇到了问题，我读过SQL注入和prepared语句，但我不明白如何使用prepared语句处理/避免SQL注入攻击。在我的代码中，我对它很陌生，请帮助我

EmployeeDao.java类

  public class EmployeeDAO {

// Database fields
private SQLiteDatabase database;
private EmployeeDatabaseHelper dbHelper;

private String[] allColumns = {
  // all column name
 };

public EmployeeDAO(Context context) {
    dbHelper = new EmployeeDatabaseHelper(context);
}

public void open() throws SQLException {
    database = dbHelper.getWritableDatabase();
}

public void close() {
    dbHelper.close();
}

public void saveEmployeeDetails(Employee employee) {

    try {
        truncateEmployeeDetails();
        ContentValues values = new ContentValues();

        values.put(EmployeeContract.EmployeeEntry.COLUMN_NAME_AD_ID, CryptoHelper.encrypt(employee.getAdId()));
        values.put(EmployeeContract.EmployeeEntry.COLUMN_NAME_CODE, CryptoHelper.encrypt(employee.getCode()));
        values.put(EmployeeContract.EmployeeEntry.COLUMN_NAME_EMAIL, CryptoHelper.encrypt(employee.getEmail()));
        values.put(EmployeeContract.EmployeeEntry.COLUMN_NAME_FIRST_NAME, CryptoHelper.encrypt(employee.getFirstName()));
        values.put(EmployeeContract.EmployeeEntry.COLUMN_NAME_GENDER, CryptoHelper.encrypt(employee.getGender()));
        values.put(EmployeeContract.EmployeeEntry.COLUMN_NAME_PK_ID, CryptoHelper.encrypt(String.valueOf(employee.getId())));
        values.put(EmployeeContract.EmployeeEntry.COLUMN_NAME_IMEI, CryptoHelper.encrypt(employee.getImei()));
        values.put(EmployeeContract.EmployeeEntry.COLUMN_NAME_LAST_NAME, CryptoHelper.encrypt(employee.getLastName()));
        values.put(EmployeeContract.EmployeeEntry.COLUMN_NAME_PHONE, CryptoHelper.encrypt(employee.getPhone()));

        database.insert(EmployeeContract.EmployeeEntry.TABLE_NAME, null, values);
    } catch (Exception e) {
        e.printStackTrace();
    }
}

public void truncateEmployeeDetails() {
    database.execSQL("delete from " + EmployeeContract.EmployeeEntry.TABLE_NAME);
}

public Employee getEmployeeDetails() {
    Employee employee = null;
    Cursor cursor = null;
    try {
        cursor = database.query(EmployeeContract.EmployeeEntry.TABLE_NAME,
                allColumns, null, null, null, null, null);

        cursor.moveToFirst();
        employee = cursorToEmployee(cursor);
    } catch (Exception e) {
        e.printStackTrace();
    } finally {
        if (cursor != null)
            cursor.close();
    }
    return employee;
}

private Employee cursorToEmployee(Cursor cursor) {
    Employee employee = new Employee();
    try {
        employee.setAdId(CryptoHelper.decrypt(cursor.getString(1)));
        employee.setCode(CryptoHelper.decrypt(cursor.getString(2)));
        employee.setEmail(CryptoHelper.decrypt(cursor.getString(3)));
        employee.setFirstName(CryptoHelper.decrypt(cursor.getString(4)));
        employee.setGender(CryptoHelper.decrypt(cursor.getString(5)));
        employee.setId(Long.parseLong(CryptoHelper.decrypt(cursor.getString(6))));
        employee.setImei(CryptoHelper.decrypt(cursor.getString(7)));
        employee.setLastName(CryptoHelper.decrypt(cursor.getString(8)));
        employee.setPhone(CryptoHelper.decrypt(cursor.getString(9)));
    } catch (Exception e) {
        e.printStackTrace();
    }

    return employee;
}}

---

我用事先准备好的陈述解决了这个问题

SQLiteStatement sqLiteStatement = database.compileStatement("" +
                        "INSERT INTO " +
                        EmployeeContract.EmployeeEntry.TABLE_NAME +
                        " ( " +
                        EmployeeContract.EmployeeEntry.COLUMN_NAME_AD_ID +
                        "," +
                        EmployeeContract.EmployeeEntry.COLUMN_NAME_CODE +
                        "," +
                        EmployeeContract.EmployeeEntry.COLUMN_NAME_EMAIL +
                        "," +
                        EmployeeContract.EmployeeEntry.COLUMN_NAME_FIRST_NAME +
                        "," +
                        EmployeeContract.EmployeeEntry.COLUMN_NAME_GENDER +
                        "," +
                        EmployeeContract.EmployeeEntry.COLUMN_NAME_PK_ID +
                        "," +
                        EmployeeContract.EmployeeEntry.COLUMN_NAME_IMEI +
                        "," +
                        EmployeeContract.EmployeeEntry.COLUMN_NAME_LAST_NAME +
                        ","+
                        EmployeeContract.EmployeeEntry.COLUMN_NAME_PHONE +
                        " ) " +
                        " VALUES ('" + adId + "','" + code + "', '" + email + "','" + firstName + "','" + gender + "','" + pkId + "','"+ imei+"','"+ lastName +"','"+ phone +"')  ");

        sqLiteStatement.executeInsert();
        sqLiteStatement.close();

---

这不是PHP；您不需要使用准备好的语句。不过，您确实需要使用参数。我从这个链接获得了参考信息，这是防止SQL注入攻击的正确方法。事实上，这更糟。您没有像

ContentValues

和

insert（）

那样使用变量；相反，您将数据按原样包含在原始SQL中，从而启用SQL注入。在我的问题代码中，我使用了ContentValues和insert（），但从代码检查中，我发现了SQL注入问题，那么什么是正确的解决方案

ContentValues

和

insert（）

注入方面没有问题。代码审阅者也可能是错误的。