I would like to know if my java db class is enough protected against hackers. (I'm currently developing an Android application). I protect it with a infos.properties file which contains every information that I need.

final class DB {
static final String DRIVER;
static final String URL;
static final String USER;
static final String PASSWORD;

static {
Properties prop = new Properties();
try {
    prop.load(new FileInputStream("infos.properties"));
} catch (IOException e) {
DRIVER = prop.getProperty("DRIVER");
URL = prop.getProperty("URL");
USER = prop.getProperty("user");
PASSWORD = prop.getProperty("password");

public static ResultSet doQuery(String query)
    try {
        Connection conn = DriverManager.getConnection(URL, USER, PASSWORD);
        Statement stmt = conn.createStatement();
        ResultSet rs = stmt.executeQuery(query);
        if (rs != null) rs.close();
        if (stmt != null) stmt.close();
        if (conn != null) conn.close();
        return (rs);
    } catch (ClassNotFoundException e) {
    } catch (SQLException e) {
    return null;

If it is not enough protected, what should I do then ?

  • 5
    \$\begingroup\$ Its never secure. Ever. \$\endgroup\$ – David says Reinstate Monica May 14 '14 at 18:39
  • \$\begingroup\$ Besides what that answers said about the actual security problem, this code has a lot of issues in terms of quality. \$\endgroup\$ – Ingo Bürk May 14 '14 at 18:53
  • 2
    \$\begingroup\$ @IngoBürk Feel free to add another answer addressing those issues! \$\endgroup\$ – Simon Forsberg May 14 '14 at 20:43
  • \$\begingroup\$ @SimonAndréForsberg I would have, but it's not the kind of review the OP asked for, so I wanted to "probe" them first :) \$\endgroup\$ – Ingo Bürk May 15 '14 at 9:28

If possible I would try to avoid a method like doQuery(String query). If someone manages to manipulate the query this becomes a classical injection problem.

If you do not need the flexibility to make any kind of db requests, use prepared statements for specific requests which only get some parameters.

  • \$\begingroup\$ I have got another problem, I can't laod the infos.properties because my android application can't find it, do you know where he have to be ? \$\endgroup\$ – Guest13800 May 14 '14 at 11:59
  • 1
    \$\begingroup\$ @Guest13800: I am not an Android developer. Try a search engine or StackOverflow. \$\endgroup\$ – MrSmith42 May 14 '14 at 12:42

Do not store the connection information in a file unencrypted

Assuming that you are connecting to a database somewhere on the internet... If you plan on distributing this application, do not store the connection information unencrypted in a file on the user's device. In fact, preferably don't store the database connection information at all.

Do not let your Android application connect directly to your remote database!

It is not recommended to let your Android application, or any other distributed application, connect directly to your database. This is because it is very easy to decompile an application, which would give information about the connection details, your database structure, and a whole lot of other things.

Instead, perform connections to a server-side script or application that is responsible for handling the connection between your Android application and your database. Only let this script/application that only you control deal with the database connection.

Unless you deal with this, any number of prepared statements your application itself uses doesn't matter, as a user could just find out the connection details from your application and then create their own connection to the database server.

  • 1
    \$\begingroup\$ Depending on exactly what the application is, it may be worth simply using a local database on the Android device. Obviously this doesn't work for all applications, but it doesn't really matter if the user has the DB connection info if the DB is simply local information the user already had access to. At that point, the DB simply becomes a storage medium for keeping state between iterations of the program. \$\endgroup\$ – Brian S May 14 '14 at 17:22
  • 1
    \$\begingroup\$ @BrianS Absolutely, if it's a local database then no harm is done. I assumed that this was a database that is connected to the internet, as the connection information is "protected" inside the infos.properties file. \$\endgroup\$ – Simon Forsberg May 14 '14 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.