prevention_SQLinjection

public class SQLInjectionPrevention {
    public static PreparedStatement createSafeStatement(Connection conn, 
            String sql, Object... params) throws SQLException {
        PreparedStatement stmt = conn.prepareStatement(sql);
        for (int i = 0; i < params.length; i++) {
            stmt.setObject(i + 1, params[i]);
        }
        return stmt;
    }

    // Ejemplo de uso seguro
    public User findUser(Connection conn, String username) throws SQLException {
        String sql = "SELECT * FROM users WHERE username = ?";
        try (PreparedStatement stmt = createSafeStatement(conn, sql, username)) {
            ResultSet rs = stmt.executeQuery();
            if (rs.next()) {
                return new User(
                    rs.getLong("id"),
                    rs.getString("username"),
                    rs.getString("email")
                );
            }
            return null;
        }
    }
}