Invalid JDBC Parameter or Column Index
ID |
java.preparedstatement_resultset_methods_called_valid |
Severity |
critical |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
reliability |
Description
Reports a PreparedStatement setter (setString, setInt, setDate, …) or a ResultSet getter (getString, getInt, getDate, …) called with a compile-time-resolvable index below 1.
Rationale
Both PreparedStatement parameters and ResultSet columns are numbered starting at 1, not 0. Calling one of these methods with index 0 or a negative value always throws SQLException at runtime, regardless of how many parameters or columns the statement actually has:
PreparedStatement ps = connection.prepareStatement("INSERT INTO users (name) VALUES (?)");
ps.setString(0, name); // always throws SQLException
ResultSet rs = ps.executeQuery();
rs.getString(0); // always throws SQLExceptionRemediation
Start indexing parameters and columns at 1:
PreparedStatement ps = connection.prepareStatement("INSERT INTO users (name) VALUES (?)");
ps.setString(1, name);
ResultSet rs = ps.executeQuery();
rs.getString(1);