Re: is JSP&servelet web app SQL Injection Free?

[David Howe <DaveHowe.Pentest () googlemail com>]

salamond wrote:
> Hi, all.
>
> I'm new to pen-testing.
>
> Just finished my tour with a couple of tools:
> webscarab
> sqlmap
> ratproxy
>
> But it shows OK for every page that I've been through.
>
> I went through a couple of SQL Injection tutorial, and most of them
> are focusing on
> php or asp pages.
>
> So here's my question, it may sound stupid, but
> is there no SQL Injection problems in JSP&Java sevelet web app?

sure. however, there are no practical differences between not sanitizing
input on php/asp to not sanitizing input on jsp/perl/ruby/whatever

most of the differences are to do with the backend sql engine, not the
active content language.