Java String Security: Handling Passwords, SQL, and User Input

1. Why char[] is Safer for Passwords

The Problem with String

• Immutability: String values remain in memory until garbage-collected, risking exposure in memory dumps.
• Logging Risks: Accidentally logging passwords (e.g., System.out.println(password)).

Solution: Use char[]

char[] password = passwordField.getPassword();  

// Wipe the array after use to minimize exposure  
Arrays.fill(password, '\0');  

Best Practices:

1. Never Store Passwords as String: Use char[] or specialized classes like SecureString.
2. Avoid String in Logs: Mask sensitive data in debug outputs.
3. Use JPasswordField in Swing: Returns char[] by default.

2. Preventing SQL Injection

The Danger of String Concatenation

// 🚨 Vulnerable code!  
String query = "SELECT * FROM users WHERE name = '" + userInput + "'";  

A malicious userInput like ' OR '1'='1 can bypass authentication.

Solution: Parameterized Queries

Use PreparedStatement to separate SQL logic from data:

String query = "SELECT * FROM users WHERE name = ?";  
try (PreparedStatement stmt = connection.prepareStatement(query)) {  
    stmt.setString(1, userInput);  // Automatically escapes input  
    ResultSet rs = stmt.executeQuery();  
}  

Key Benefits:

• Escapes special characters (e.g., ', ").
• Prevents malicious SQL execution.

For ORM Users: Frameworks like Hibernate/JPA also use parameterization internally.

3. Validating and Sanitizing User Input

Input Validation Rules

• Whitelist Valid Characters: Reject anything outside expected patterns.
• Use Regex for Format Checks:

if (!email.matches("^[\\w.-]+@[\\w.-]+\\.\\w+$")) {  
    throw new InvalidInputException("Invalid email");  
}  

Sanitization Techniques

• Escape HTML/JavaScript: Prevent XSS attacks in web apps.

String safeOutput = Encode.forHtml(userInput);  // OWASP Java Encoder  

• Limit Input Length:

if (userInput.length() > MAX_LENGTH) {  
    throw new InputTooLongException();  
}  

Common Security Mistakes

❌ Storing Secrets in String:

String apiKey = "sk_live_12345";  // Visible in memory dumps!  

❌ Trusting Input from Untrusted Sources:

String filename = userInput + ".txt";  
Files.write(Path.of(filename), data);  // Path traversal risk!  

❌ Logging Sensitive Data:

logger.info("User password reset: " + password);  // Exposed in logs!  

Best Practices

1. Use char[] for Passwords: Wipe it immediately after use.
2. Parameterize All Queries: Never concatenate SQL.
3. Validate Before Processing: Assume all input is malicious.
4. Sanitize for Context: HTML, SQL, OS commands, etc.
5. Leverage Security Libraries:
   • OWASP Java Encoder
   • Hibernate Validator

FAQ