No SELECT * In SQL Queries
ID |
java.jdbc_no_select_star |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Efficiency |
Language |
Java |
Tags |
efficiency |
Rationale
SELECT * fetches every column in the table, which wastes bandwidth and memory when only a subset of columns is needed. It also couples the code to the current table schema — adding a new column to the table silently changes the result set, potentially breaking assumptions in the application layer.
// Bad - fetches all columns
stmt.executeQuery("SELECT * FROM users");Remediation
List the specific columns required by the query.
// Good - explicit column list
stmt.executeQuery("SELECT id, name, email FROM users");