Penetration Testing: Re: is JSP&servelet web app SQL Injection Free?

[Taufiq Ali <taufiq.ali () niiconsulting com>]

Hey JarodZZ,

SQL injections are independent of programming languages. SQL injection is basically an art to 
manipulate SQL queries & will exist with any web application that if not coded as per secure coding 
guidelines or at least implement some validation to filter expected characters from the GET or POST 
request that contribute towards SQL injection.
cheers
Taufiq

-------- Original Message --------
Subject: is JSP&servelet web app SQL Injection Free?
From: salamond <jarodzz () gmail com>
To: pen-test () securityfocus com
Date: 1/5/2009 1:58 PM

> Hi, all.
>
> I'm new to pen-testing.
>
> Just finished my tour with a couple of tools:
> webscarab
> sqlmap
> ratproxy
>
> But it shows OK for every page that I've been through.
>
> I went through a couple of SQL Injection tutorial, and most of them
> are focusing on
> php or asp pages.
>
> So here's my question, it may sound stupid, but
> is there no SQL Injection problems in JSP&Java sevelet web app?
>
> thanks
>
> JarodZZ