How to avoid SQL injection when a query is coming as a parameter of a method in Java?

Question

public static RepositoryItem[] executeQuery(Repository repository, String query,Object[] params)
{
    RepositoryItem[] data = null;

    try {
        RepositoryView repositoryView = repository.getView(viewName);
        RqlStatement statement = RqlStatement.parseRqlStatement(query);
    }
}

The query is a parameterized query.

Answer 1

Depending on which database your are using, you could define the SQL connection or DBConnectionPool using credentials of a user which has readonly access. Any statement which is unauthorized will be rejected by the DBMS.