🔒 Fix SQL Injection in MainController.loadBookInfo2

src/library/assistant/database/DataHelper.java

@@ -146,4 +146,29 @@ public static MailServerInfo loadMailServerInfo() {
         }
         return null;
     }
+
+    public static ResultSet getIssueDetails(String bookID) {
+        return getIssueDetails(bookID, DatabaseHandler.getInstance().getConnection());
+    }
+
+    public static ResultSet getIssueDetails(String bookID, Connection conn) {
+        ResultSet rs = null;
+        try {
+            String query = "SELECT ISSUE.bookID, ISSUE.memberID, ISSUE.issueTime, ISSUE.renew_count,\n"
+                    + "MEMBER.name, MEMBER.mobile, MEMBER.email,\n"
+                    + "BOOK.title, BOOK.author, BOOK.publisher\n"
+                    + "FROM ISSUE\n"
+                    + "LEFT JOIN MEMBER\n"
+                    + "ON ISSUE.memberID=MEMBER.ID\n"
+                    + "LEFT JOIN BOOK\n"
+                    + "ON ISSUE.bookID=BOOK.ID\n"
+                    + "WHERE ISSUE.bookID=?";
+            PreparedStatement stmt = conn.prepareStatement(query);
+            stmt.setString(1, bookID);
+            rs = stmt.executeQuery();
+        } catch (SQLException ex) {
+            LOGGER.log(Level.ERROR, "{}", ex);
+        }
+        return rs;
+    }
 }

src/library/assistant/ui/main/MainController.java

@@ -273,16 +273,7 @@ private void loadBookInfo2(ActionEvent event) {
 
         try {
             String id = bookID.getText();
-            String myQuery = "SELECT ISSUE.bookID, ISSUE.memberID, ISSUE.issueTime, ISSUE.renew_count,\n"
-                    + "MEMBER.name, MEMBER.mobile, MEMBER.email,\n"
-                    + "BOOK.title, BOOK.author, BOOK.publisher\n"
-                    + "FROM ISSUE\n"
-                    + "LEFT JOIN MEMBER\n"
-                    + "ON ISSUE.memberID=MEMBER.ID\n"
-                    + "LEFT JOIN BOOK\n"
-                    + "ON ISSUE.bookID=BOOK.ID\n"
-                    + "WHERE ISSUE.bookID='" + id + "'";
-            ResultSet rs = databaseHandler.execQuery(myQuery);
+            ResultSet rs = DataHelper.getIssueDetails(id);
             if (rs.next()) {
                 memberNameHolder.setText(rs.getString("name"));
                 memberContactHolder.setText(rs.getString("mobile"));

test/library/assistant/database/DataHelperTest.java

@@ -64,4 +64,22 @@ public void testInsertNewBookException() throws SQLException {
         // Assert
         assertFalse(result);
     }
+
+    @Test
+    public void testGetIssueDetails() throws SQLException {
+        // Arrange
+        Connection mockConn = mock(Connection.class);
+        PreparedStatement mockStmt = mock(PreparedStatement.class);
+        String bookID = "B123";
+
+        when(mockConn.prepareStatement(anyString())).thenReturn(mockStmt);
+
+        // Act
+        DataHelper.getIssueDetails(bookID, mockConn);
+
+        // Assert
+        verify(mockConn).prepareStatement(contains("WHERE ISSUE.bookID=?"));
+        verify(mockStmt).setString(1, bookID);
+        verify(mockStmt).executeQuery();
+    }
 }