CVE-2015-10034: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability has been found in j-nowak workout-organizer and classified as critical. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as 13cd6c3d1210640bfdb39872b2bb3597aa991279. It is recommended to apply a patch to fix this issue. VDB-217714 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-09T21:15Z
Repository: https://github.com/j-nowak/workout-organizer
Language: Java
Files changed: src/app/controllers/AccountController.java, src/app/controllers/Application.java, src/app/controllers/UsersController.java, src/app/database/ExerciseDao.java, src/app/database/GymsDao.java, src/app/database/UsersDao.java, src/app/database/WorkoutDao.java
Commit date: 2015-02-03 21:22:56 +0100
Commit message: Fixed building queries - preventing SQL-injection

Diff: diff --git a/src/app/controllers/AccountController.java b/src/app/controllers/AccountController.java
index a746c48..98f70b7 100644
--- a/src/app/controllers/AccountController.java
+++ b/src/app/controllers/AccountController.java
@@ -1,9 +1,8 @@
 package controllers;
 
-import java.util.HashMap;
-import java.util.Map;
+import java.sql.Date;
 
 import models.Secured;
 import play.data.DynamicForm;
 import play.data.Form;
 import play.mvc.Controller;
@@ -17,14 +16,21 @@ public class AccountController extends Controller {
 	public static Result changePassword() {
 		DynamicForm requestData = Form.form().bindFromRequest();
 		String oldPassword = requestData.get("oldPassword");
 		String newPassword = requestData.get("newPassword");
 		String repeatedPassword = requestData.get("repeatedPassword");
+		int userId;
+		try {
+			userId = Integer.parseInt(session(Application.USER_ID));
+		} catch (Exception e) {
+			e.printStackTrace();
+			return badRequest();
+		}
 		
 		if (newPassword.equals(repeatedPassword)) {
-			if (UsersDao.get().checkPasswordForUser(session().get(Application.USER_ID), oldPassword)) {
-				UsersDao.get().changePassword(session().get(Application.USER_ID), newPassword);
+			if (UsersDao.get().checkPasswordForUser(userId, oldPassword)) {
+				UsersDao.get().changePassword(userId, newPassword);
 				return ok();
 			}
 			else {
 				return badRequest("Old password is incorrect!");
 			}
@@ -33,31 +39,35 @@ public class AccountController extends Controller {
 			return badRequest("New and repeated passwords are different!");
 		}
 	}
 	
 	public static Result changeUserInfo() {
-		String userId = session(Application.USER_ID);
 		DynamicForm requestData = Form.form().bindFromRequest();
-		String weight = requestData.get("weight");
-		String height = requestData.get("height");
-		String dateOfBirth = requestData.get("dateOfBirth");
-
-		Map<String, String> toUpdate = new HashMap<String, String>();
-		if (!weight.equals("")) {
-			toUpdate.put("weight", weight);
-		}
-		if (!height.equals("")) {
-			toUpdate.put("height", height);
-		}
-		if (!dateOfBirth.equals("")) {
-			toUpdate.put("date_of_birth", dateOfBirth);
+		Double weight = null;
+		Double height = null;
+		Date dateOfBirth = null;
+		int userId;
+		try {
+			userId = Integer.parseInt(session(Application.USER_ID));
+		} catch (Exception e) {
+			e.printStackTrace();
+			return badRequest();
 		}
-		
 
-		if (toUpdate.size() > 0 && UsersDao.get().update(userId, toUpdate)) {
-			return ok();
-		}
-		else {
+		if (!requestData.get("weight").equals(""))
+			weight = Double.valueOf(requestData.get("weight"));
+		if (!requestData.get("height").equals(""))
+			height = Double.valueOf(requestData.get("height"));
+		if (!requestData.get("dateOfBirth").equals(""))
+			dateOfBirth = Date.valueOf(requestData.get("dateOfBirth"));
+
+		try {
+			if (UsersDao.get().update(userId, weight, height, dateOfBirth))
+				return ok();
+			else
+				return badRequest();
+		} catch (Exception e) {
+			e.printStackTrace();
 			return badRequest();
 		}
 	}
 }
diff --git a/src/app/controllers/Application.java b/src/app/controllers/Application.java
index 03bd5bb..64c1ba0 100644
--- a/src/app/controllers/Application.java
+++ b/src/app/controllers/Application.java
@@ -34,10 +34,15 @@ public class Application extends Controller {
     		return ok(index.render(news, strangers, friendshipRequests));
     	}
     }
     
     public static Result editAccountSettings() {
-    	User user = UsersDao.get().getById(session(USER_ID)); //TODO change session to userId
-    	return ok(account.render(user));
+    	try {
+	    	User user = UsersDao.get().getById(Integer.parseInt(session(USER_ID))); //TODO change session to userId
+	    	return ok(account.render(user));
+    	} catch (Exception e) {
+    		e.printStackTrace();
+    		return badRequest();
+    	}
     }
 
 }
diff --git a/src/app/controllers/UsersController.java b/src/app/controllers/UsersController.java
index ad83047..5031ba3 100644
--- a/src/app/controllers/UsersController.java
+++ b/src/app/controllers/UsersController.java
@@ -28,11 +28,11 @@ public class UsersController extends Controller {
 		}
 	}
 	
 	public static Result showUser(int foreignerId) {
 		int userId = Integer.parseInt(session("user_id"));
-		User user = UsersDao.get().getById(foreignerId + "");
+		User user = UsersDao.get().getById(foreignerId);
 		boolean isYourFriend = UsersDao.get().areFriends(userId, foreignerId);
 		if (user != null) {
 			return ok(user_info.render(user, isYourFriend));			
 		}
 		else {
diff --git a/src/app/database/ExerciseDao.java b/src/app/database/ExerciseDao.java
index 29d4b26..770123a 100644
--- a/src/app/database/ExerciseDao.java
+++ b/src/app/database/ExerciseDao.java
@@ -1,8 +1,9 @@
 package database;
 
 import java.sql.Connection;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Statement;
 import java.util.ArrayList;
 import java.util.HashSet;
@@ -96,14 +97,17 @@ public class ExerciseDao {
 	
 	public void rateExercise(int userId, int exerciseId, int rating) {
 		Connection connection = null;
 		try {
 			connection = DB.getConnection();
-			String sql = connection.nativeSQL("INSERT INTO exercise_ratings(user_id, exercise_id, rating) VALUES" + 
-					"  (" + userId + ", " + exerciseId + ", " + rating + ");");
-			play.Logger.info("Insert exercise_rating: " + sql);
-			connection.createStatement().execute(sql);
+			PreparedStatement p = connection.prepareStatement("INSERT INTO exercise_ratings(user_id, exercise_id, rating) VALUES (?, ?, ?);");
+			p.setInt(1, userId);
+			p.setInt(2, exerciseId);
+			p.setInt(3, rating);
+			
+			p.executeQuery();
+			p.close();
 		} catch (SQLException e) {
 			e.printStackTrace();
 		} finally {
 			if (connection != null) {
 				try {
@@ -121,26 +125,27 @@ public class ExerciseDao {
 
 	public ExerciseResult getBestForUser(String userId, int exerciseId) {
 		Connection connection = null;
 		try {
 			connection = DB.getConnection();
-			Statement statement = connection.createStatement();
-			ResultSet resultSet = statement.executeQuery("SELECT weight, set_count, reps_per_set" + 
-					"		FROM workout_entries" + 
-					"		JOIN workouts USING (workout_id)" + 
-					"		WHERE user_id = " + userId + " AND exercise_id = " + exerciseId + 
-					"		ORDER BY weight" + 
-					"		LIMIT 1;");
+			PreparedStatement p = connection.prepareStatement("SELECT weight, set_count, reps_per_set"
+					+ "FROM workout_entries "
+					+ "JOIN workouts USING (workout_id) "
+					+ "WHERE user_id = ? AND exercise_id = ? "
+					+ "ORDER BY weight"
+					+ "LIMIT 1;");
+			ResultSet resultSet = p.executeQuery();
 			ExerciseResult result = null;
 			if (resultSet.next()) {
 				result = new ExerciseResult();
 				result.setRepsPerSet(resultSet.getInt("reps_per_set"));
 				result.setSetCount(resultSet.getInt("set_count"));
 				result.setWeight(resultSet.getInt("weight"));
 				
 			}
-			
+			resultSet.close();
+			p.close();
 			return result;
 		} catch (SQLException e) {
 			e.printStackTrace();
 			return null;
 		} finally {
diff --git a/src/app/database/GymsDao.java b/src/app/database/GymsDao.java
index 8fdc814..73d3765 100644
--- a/src/app/database/GymsDao.java
+++ b/src/app/database/GymsDao.java
@@ -1,8 +1,9 @@
 package database;
 
 import java.sql.Connection;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Statement;
 import java.util.ArrayList;
 import java.util.List;
@@ -65,14 +66,16 @@ public class GymsDao {
 	
 	public void rateGym(int userId, int gymId, int rating) {
 		Connection connection = null;
 		try {
 			connection = DB.getConnection();
-			String sql = connection.nativeSQL("INSERT INTO gym_ratings(user_id, gym_id, rating) VALUES" + 
-					"  (" + userId + ", " + gymId + ", " + rating + ");");
-			play.Logger.info("Insert gym_rating: " + sql);
-			connection.createStatement().execute(sql);
+			PreparedStatement p = connection.prepareStatement("INSERT INTO gym_ratings(user_id, gym_id, rating) VALUES (?, ?, ?)");
+			p.setInt(1, userId);
+			p.setInt(2, gymId);
+			p.setInt(3, rating);
+			p.executeQuery();
+			p.close();
 		} catch (SQLException e) {
 			e.printStackTrace();
 		} finally {
 			if (connection != null) {
 				try {
diff --git a/src/app/database/UsersDao.java b/src/app/database/UsersDao.java
index 7928636..65d39cd 100644
--- a/src/app/database/UsersDao.java
+++ b/src/app/database/UsersDao.java
@@ -1,18 +1,16 @@
 package database;
 
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.sql.Connection;
+import java.sql.Date;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
-import java.sql.Statement;
 import java.util.ArrayList;
 import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
 
 import models.Stranger;
 import models.User;
 import play.Logger;
 import play.db.DB;
@@ -32,25 +30,30 @@ public class UsersDao {
 		Connection connection = null;
 		try {
 			connection = DB.getConnection();
 			String passwordDigest = byteArrayToHexString(MessageDigest
 					.getInstance("SHA-1").digest(user.getPassword().getBytes()));
-			String sql = connection.nativeSQL("INSERT INTO users(login, email, password_digest, first_name, last_name) VALUES" + 
-					"  ('" + user.getLogin() + "','" + user.getEmail() + "','" + passwordDigest + "','" + user.getFirstName() + "','" + user.getLastName() + "')");
-			
-			play.Logger.info("Insert user: " + sql);
-			connection.createStatement().execute(sql);
+			PreparedStatement p = connection.prepareStatement("INSERT INTO users(login, email, password_digest, first_name, last_name) VALUES (?, ?, ?, ?, ?)");
+			p.setString(1, user.getLogin());
+			p.setString(2, user.getEmail());
+			p.setString(3, passwordDigest);
+			p.setString(4, user.getFirstName());
+			p.setString(5, user.getLastName());
+			p.executeQuery();
+			p.close();
 			
-			Statement statement = connection.createStatement();
-			ResultSet result = statement.executeQuery("SELECT * FROM users WHERE login = '" + user.getLogin() +"'");
+			p = connection.prepareStatement("SELECT * FROM users WHERE login = ?");
+			p.setString(1, user.getLogin());
+			ResultSet result = p.executeQuery();
 			if (result.next()){
 				user.setId(result.getInt("user_id"));				
 			}
 			else {
 				throw new SQLException("Insert error");
 			}
-			
+			result.close();
+			p.close();
 			return true;
 		} catch (SQLException e) {
 			e.printStackTrace();
 			return false;
 		} catch (NoSuchAlgorithmException e) {
@@ -69,15 +72,17 @@ public class UsersDao {
 
 	public User login(String login, String password) {
 		Connection connection = null;
 		try {
 			connection = DB.getConnection();
-			Statement getuserStatement = connection.createStatement();
 			String passwordDigest = byteArrayToHexString(MessageDigest
 					.getInstance("SHA-1").digest(password.getBytes()));
-			ResultSet resultUser = getuserStatement.executeQuery("SELECT * FROM users "
-					+ "WHERE (login = '" + login + "' OR email = '" + login + "') AND password_digest = '" + passwordDigest + "'");
+			PreparedStatement p = connection.prepareStatement("SELECT * FROM users WHERE (login = ? OR email = ?) AND password_digest = ?");
+			p.setString(1, login);
+			p.setString(2, login);
+			p.setString(3, passwordDigest);
+			ResultSet resultUser = p.executeQuery();
 			
 			User user = null;
 			if (resultUser.next()) {
 				Logger.info("User " + resultUser.getString("login") + " logged in!");
 				user = new User();
@@ -85,11 +90,11 @@ public class UsersDao {
 				user.setLogin(resultUser.getString("login"));
 				user.setEmail(resultUser.getString("email"));
 			}
 			
 			resultUser.close();
-			getuserStatement.close();
+			p.close();
 			
 			return user;
 		} catch (SQLException e) {
 			e.printStackTrace();
 			return null;
@@ -113,17 +118,18 @@ public class UsersDao {
 			result += Integer.toString((b[i] & 0xff) + 0x100, 16).substring(1);
 		}
 		return result;
 	}
 
-	public User getById(String userId) { //TODO change to userId
+	public User getById(int userId) {
 		Connection connection = null;
 		try {
 			connection = DB.getConnection();
-			Statement getuserStatement = connection.createStatement();
-			ResultSet resultUser = getuserStatement.executeQuery("SELECT * FROM users "
-					+ "WHERE user_id = '" + userId + "'");
+			PreparedStatement p = connection.prepareStatement("SELECT * FROM users WHERE user_id = ?");
+			p.setInt(1, userId);
+			
+			ResultSet resultUser = p.executeQuery();
 			
 			User user = null;
 			if (resultUser.next()) {
 				user = new User();
 				user.setId(resultUser.getInt("user_id"));
@@ -135,11 +141,11 @@ public class UsersDao {
 				user.setHeight(resultUser.getInt("height"));
 				user.setWeight(resultUser.getDouble("weight"));
 			}
 			
 			resultUser.close();
-			getuserStatement.close();
+			p.close();
 			
 			return user;
 		} catch (SQLException e) {
 			e.printStackTrace();
 			return null;
@@ -152,31 +158,32 @@ public class UsersDao {
 				}
 			}
 		}
 	}
 
-	public boolean checkPasswordForUser(String userId, String password) {
+	public boolean checkPasswordForUser(int userId, String password) {
 		Connection connection = null;
 		try {
 			String passwordDigest = byteArrayToHexString(MessageDigest
 					.getInstance("SHA-1").digest(password.getBytes()));
 			
 			connection = DB.getConnection();
-			Statement getuserStatement = connection.createStatement();
-			ResultSet resultUser = getuserStatement.executeQuery("SELECT * FROM users "
-					+ "WHERE user_id = '" + userId + "' AND password_digest = '" + passwordDigest + "'");
+			PreparedStatement p = connection.prepareStatement("SELECT * FROM users WHERE user_id = ? AND password_digest = ?");
+			p.setInt(1, userId);
+			p.setString(2, passwordDigest);
+			ResultSet resultUser = p.executeQuery();
 			
 			boolean result;
 			if (resultUser.next()) {
 				result = true;
 			}
 			else {
 				result = false;
 			}
 			
 			resultUser.close();
-			getuserStatement.close();
+			p.close();
 			return result;
 		} catch (SQLException e) {
 			e.printStackTrace();
 			return false;
 		} catch (NoSuchAlgorithmException e) {
@@ -191,23 +198,24 @@ public class UsersDao {
 				}
 			}
 		}
 	}
 
-	public void changePassword(String userId, String password) {
+	public void changePassword(int userId, String password) {
 		Connection connection = null;
 		try {
 			String passwordDigest = byteArrayToHexString(MessageDigest
 					.getInstance("SHA-1").digest(password.getBytes()));
 			
 			connection = DB.getConnection();
-			Statement statement = connection.createStatement();
-			String sql = "UPDATE users SET password_digest = '"+ passwordDigest + "' where user_id = '" + userId + "';";
-			statement.executeUpdate(sql);
+			PreparedStatement p = connection.prepareStatement("UPDATE users SET password_digest = ? where user_id = ?");
+			p.setString(1, passwordDigest);;
+			p.setInt(2, userId);
+			p.executeQuery();
+			p.close();
 			play.Logger.info("Password changed!");
 			
-			statement.close();
 		} catch (SQLException e) {
 			e.printStackTrace();
 		} catch (NoSuchAlgorithmException e) {
 			e.printStackTrace();
 		} finally {
@@ -219,27 +227,42 @@ public class UsersDao {
 				}
 			}
 		}
 	}
 
-	public boolean update(String userId, Map<String, String> toUpdate) {
+	public boolean update(int userId, Double weight, Double height, Date dateOfBirth) {
 		Connection connection = null;
 		try {	
 			connection = DB.getConnection();
-			Statement statement = connection.createStatement();
-			String sql = "UPDATE users SET ";
-			for (Entry<String, String> entry : toUpdate.entrySet()) {
-				sql += entry.getKey() + " = '" + entry.getValue() + "', ";
-			}
+			String sql = "UPDATE users SET   ";
+			if (weight != null)
+				sql += "weight = ?, ";
+			if (height != null)
+				sql += "height = ?, ";
+			if (dateOfBirth != null)
+				sql += "date_of_birth = ?, ";
 			sql = sql.substring(0, sql.length() - 2);
-			sql += " where user_id = '" + userId + "';";
+			sql += " WHERE user_id = ?";
 			
-			play.Logger.info(sql);
-			statement.executeUpdate(sql);
+			PreparedStatement p = connection.prepareStatement(sql);
+
+			int i = 1;
+			if (weight != null)
+				p.setDouble(i++, weight);
+			if (height != null)
+				p.setDouble(i++, height);
+			if (dateOfBirth != null)
+				p.setDate(i++, dateOfBirth);
 			
+			p.setInt(i, userId);
+
+			play.Logger.info(sql);
+
+			if (i > 1)
+				p.executeUpdate();
 			
-			statement.close();
+			p.close();
 			return true;
 		} catch (SQLException e) {
 			e.printStackTrace();
 			return false;
 		} finally {
@@ -257,12 +280,13 @@ public class UsersDao {
 		List<Stranger> strangers = new ArrayList<>();
 		
 		Connection connection = null;
 		try {	
 			connection = DB.getConnection();
-			Statement statement = connection.createStatement();
-			ResultSet resultSet = statement.executeQuery("SELECT * FROM random_strangers_of_user(" + userId + ")");
+			PreparedStatement p = connection.prepareStatement("SELECT * FROM random_strangers_of_user(?)");
+			p.setInt(1, userId);
+			ResultSet resultSet = p.executeQuery();
 			
 			Stranger stranger = null;
 			while (resultSet.next()) {
 				stranger = new Stranger();
 				stranger.setId(resultSet.getInt("id"));
@@ -270,11 +294,11 @@ public class UsersDao {
 				stranger.setLastName(resultSet.getString("last_name"));
 				strangers.add(stranger);
 			}
 			
 			resultSet.close();
-			statement.close();
+			p.close();
 		} catch (SQLException e) {
 			e.printStackTrace();
 		} finally {
 			if (connection != null) {
 				try {
diff --git a/src/app/database/WorkoutDao.java b/src/app/database/WorkoutDao.java
index bc32cc6..fa7c79a 100644
--- a/src/app/database/WorkoutDao.java
+++ b/src/app/database/WorkoutDao.java
@@ -2,11 +2,10 @@ package database;
 
 import java.sql.Connection;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
-import java.sql.Statement;
 import java.sql.Timestamp;
 import java.sql.Types;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -23,22 +22,59 @@ public class WorkoutDao {
 	}
 	
 	private WorkoutDao() {}
 	
 	public List<Workout> getAll() {
-		return getWorkouts("SELECT workouts.*, gyms.gym_name "
-				+ "FROM workouts "
-				+ "LEFT JOIN gyms using (gym_id) "
-				+ "ORDER BY workouts.finished_at DESC");
+		List<Workout> workouts = new ArrayList<Workout>();
+		Connection connection = null;
+		try {
+			connection = DB.getConnection();
+			PreparedStatement p = connection.prepareStatement("SELECT workouts.*, gyms.gym_name "
+					+ "FROM workouts "
+					+ "LEFT JOIN gyms using (gym_id) "
+					+ "ORDER BY workouts.finished_at DESC");
+			workouts = buildWorkouts(p.executeQuery());
+			p.close();
+		} catch (SQLException e) {
+			e.printStackTrace();
+		} finally {
+			if (connection != null) {
+				try {
+					connection.close();
+				} catch (SQLException e) {
+					e.printStackTrace();
+				}
+			}
+		}
+		return workouts;
 	}
 	
 	public List<Workout> getUserWorkouts(int userId) {
-		return getWorkouts("SELECT workouts.*, gyms.gym_name "
-				+ "FROM workouts "
-				+ "LEFT JOIN gyms using (gym_id) "
-				+ "WHERE user_id = " + userId + " "
-				+ "ORDER BY workouts.finished_at DESC");
+		List<Workout> workouts = new ArrayList<Workout>();
+		Connection connection = null;
+		try {
+			connection = DB.getConnection();
+			PreparedStatement p = connection.prepareStatement("SELECT workouts.*, gyms.gym_name "
+					+ "FROM workouts "
+					+ "LEFT JOIN gyms using (gym_id) "
+					+ "WHERE user_id = ? "
+					+ "ORDER BY workouts.finished_at DESC");
+			p.setInt(1, userId);
+			workouts = buildWorkouts(p.executeQuery());
+			p.close();
+		} catch (SQLException e) {
+			e.printStackTrace();
+		} finally {
+			if (connection != null) {
+				try {
+					connection.close();
+				} catch (SQLException e) {
+					e.printStackTrace();
+				}
+			}
+		}
+		return workouts;
 	}
 	
 	public boolean create(Workout workout) {
 		Connection connection = null;
 		try {
@@ -114,19 +150,14 @@ public class WorkoutDao {
 				}
 			}
 		}
 	}
 	
-	private List<Workout> getWorkouts(String sql) {
+	private List<Workout> buildWorkouts(ResultSet resultSet) {
 		List<Workout> workouts = new ArrayList<Workout>();
-		
-		Connection connection = null;
+
 		try {
-			connection = DB.getConnection();
-			Statement statement = connection.createStatement();
-			ResultSet resultSet = statement.executeQuery(sql);
-			
 			while (resultSet.next()) {
 				int id = resultSet.getInt("workout_id");
 				int userId = resultSet.getInt("user_id");
 				int gymId = resultSet.getInt("gym_id");
 				Timestamp startedAt = resultSet.getTimestamp("started_at");
@@ -136,23 +167,13 @@ public class WorkoutDao {
 				w.setId(id);
 				w.setGymName(resultSet.getString("gym_name"));
 				w.setNote(note);
 				workouts.add(w);
 			}
-			
 			resultSet.close();
-			statement.close();
 		} catch (SQLException e) {
 			e.printStackTrace();
-		} finally {
-			if (connection != null) {
-				try {
-					connection.close();
-				} catch (SQLException e) {
-					e.printStackTrace();
-				}
-			}
 		}
 
 		return workouts;
 	}
 

Vulnerable code: import java.util.HashMap;
import java.util.Map;
			if (UsersDao.get().checkPasswordForUser(session().get(Application.USER_ID), oldPassword)) {
				UsersDao.get().changePassword(session().get(Application.USER_ID), newPassword);
		String userId = session(Application.USER_ID);
		String weight = requestData.get("weight");
		String height = requestData.get("height");
		String dateOfBirth = requestData.get("dateOfBirth");

		Map<String, String> toUpdate = new HashMap<String, String>();
		if (!weight.equals("")) {
			toUpdate.put("weight", weight);
		}
		if (!height.equals("")) {
			toUpdate.put("height", height);
		}
		if (!dateOfBirth.equals("")) {
			toUpdate.put("date_of_birth", dateOfBirth);
		
		if (toUpdate.size() > 0 && UsersDao.get().update(userId, toUpdate)) {
			return ok();
		}
		else {
    	User user = UsersDao.get().getById(session(USER_ID)); //TODO change session to userId
    	return ok(account.render(user));
		User user = UsersDao.get().getById(foreignerId + "");
			String sql = connection.nativeSQL("INSERT INTO exercise_ratings(user_id, exercise_id, rating) VALUES" + 
					"  (" + userId + ", " + exerciseId + ", " + rating + ");");
			play.Logger.info("Insert exercise_rating: " + sql);
			connection.createStatement().execute(sql);
			Statement statement = connection.createStatement();
			ResultSet resultSet = statement.executeQuery("SELECT weight, set_count, reps_per_set" + 
					"		FROM workout_entries" + 
					"		JOIN workouts USING (workout_id)" + 
					"		WHERE user_id = " + userId + " AND exercise_id = " + exerciseId + 
					"		ORDER BY weight" + 
					"		LIMIT 1;");
			
			String sql = connection.nativeSQL("INSERT INTO gym_ratings(user_id, gym_id, rating) VALUES" + 
					"  (" + userId + ", " + gymId + ", " + rating + ");");
			play.Logger.info("Insert gym_rating: " + sql);
			connection.createStatement().execute(sql);
import java.sql.Statement;
import java.util.Map;
import java.util.Map.Entry;
			String sql = connection.nativeSQL("INSERT INTO users(login, email, password_digest, first_name, last_name) VALUES" + 
					"  ('" + user.getLogin() + "','" + user.getEmail() + "','" + passwordDigest + "','" + user.getFirstName() + "','" + user.getLastName() + "')");
			
			play.Logger.info("Insert user: " + sql);
			connection.createStatement().execute(sql);
			Statement statement = connection.createStatement();
			ResultSet result = statement.executeQuery("SELECT * FROM users WHERE login = '" + user.getLogin() +"'");
			
			Statement getuserStatement = connection.createStatement();
			ResultSet resultUser = getuserStatement.executeQuery("SELECT * FROM users "
					+ "WHERE (login = '" + login + "' OR email = '" + login + "') AND password_digest = '" + passwordDigest + "'");
			getuserStatement.close();
	public User getById(String userId) { //TODO change to userId
			Statement getuserStatement = connection.createStatement();
			ResultSet resultUser = getuserStatement.executeQuery("SELECT * FROM users "
					+ "WHERE user_id = '" + userId + "'");
			getuserStatement.close();
	public boolean checkPasswordForUser(String userId, String password) {
			Statement getuserStatement = connection.createStatement();
			ResultSet resultUser = getuserStatement.executeQuery("SELECT * FROM users "
					+ "WHERE user_id = '" + userId + "' AND password_digest = '" + passwordDigest + "'");
			getuserStatement.close();
	public void changePassword(String userId, String password) {
			Statement statement = connection.createStatement();
			String sql = "UPDATE users SET password_digest = '"+ passwordDigest + "' where user_id = '" + userId + "';";
			statement.executeUpdate(sql);
			statement.close();
	public boolean update(String userId, Map<String, String> toUpdate) {
			Statement statement = connection.createStatement();
			String sql = "UPDATE users SET ";
			for (Entry<String, String> entry : toUpdate.entrySet()) {
				sql += entry.getKey() + " = '" + entry.getValue() + "', ";
			}
			sql += " where user_id = '" + userId + "';";
			play.Logger.info(sql);
			statement.executeUpdate(sql);
			statement.close();
			Statement statement = connection.createStatement();
			ResultSet resultSet = statement.executeQuery("SELECT * FROM random_strangers_of_user(" + userId + ")");
			statement.close();
import java.sql.Statement;
		return getWorkouts("SELECT workouts.*, gyms.gym_name "
				+ "FROM workouts "
				+ "LEFT JOIN gyms using (gym_id) "
				+ "ORDER BY workouts.finished_at DESC");
		return getWorkouts("SELECT workouts.*, gyms.gym_name "
				+ "FROM workouts "
				+ "LEFT JOIN gyms using (gym_id) "
				+ "WHERE user_id = " + userId + " "
				+ "ORDER BY workouts.finished_at DESC");
	private List<Workout> getWorkouts(String sql) {
		
		Connection connection = null;
			connection = DB.getConnection();
			Statement statement = connection.createStatement();
			ResultSet resultSet = statement.executeQuery(sql);
			
			
			statement.close();
		} finally {
			if (connection != null) {
				try {
					connection.close();
				} catch (SQLException e) {
					e.printStackTrace();
				}
			}
Fixed code: import java.sql.Date;
		int userId;
		try {
			userId = Integer.parseInt(session(Application.USER_ID));
		} catch (Exception e) {
			e.printStackTrace();
			return badRequest();
		}
			if (UsersDao.get().checkPasswordForUser(userId, oldPassword)) {
				UsersDao.get().changePassword(userId, newPassword);
		Double weight = null;
		Double height = null;
		Date dateOfBirth = null;
		int userId;
		try {
			userId = Integer.parseInt(session(Application.USER_ID));
		} catch (Exception e) {
			e.printStackTrace();
			return badRequest();
		if (!requestData.get("weight").equals(""))
			weight = Double.valueOf(requestData.get("weight"));
		if (!requestData.get("height").equals(""))
			height = Double.valueOf(requestData.get("height"));
		if (!requestData.get("dateOfBirth").equals(""))
			dateOfBirth = Date.valueOf(requestData.get("dateOfBirth"));

		try {
			if (UsersDao.get().update(userId, weight, height, dateOfBirth))
				return ok();
			else
				return badRequest();
		} catch (Exception e) {
			e.printStackTrace();
    	try {
	    	User user = UsersDao.get().getById(Integer.parseInt(session(USER_ID))); //TODO change session to userId
	    	return ok(account.render(user));
    	} catch (Exception e) {
    		e.printStackTrace();
    		return badRequest();
    	}
		User user = UsersDao.get().getById(foreignerId);
import java.sql.PreparedStatement;
			PreparedStatement p = connection.prepareStatement("INSERT INTO exercise_ratings(user_id, exercise_id, rating) VALUES (?, ?, ?);");
			p.setInt(1, userId);
			p.setInt(2, exerciseId);
			p.setInt(3, rating);
			
			p.executeQuery();
			p.close();
			PreparedStatement p = connection.prepareStatement("SELECT weight, set_count, reps_per_set"
					+ "FROM workout_entries "
					+ "JOIN workouts USING (workout_id) "
					+ "WHERE user_id = ? AND exercise_id = ? "
					+ "ORDER BY weight"
					+ "LIMIT 1;");
			ResultSet resultSet = p.executeQuery();
			resultSet.close();
			p.close();
import java.sql.PreparedStatement;
			PreparedStatement p = connection.prepareStatement("INSERT INTO gym_ratings(user_id, gym_id, rating) VALUES (?, ?, ?)");
			p.setInt(1, userId);
			p.setInt(2, gymId);
			p.setInt(3, rating);
			p.executeQuery();
			p.close();
import java.sql.Date;
			PreparedStatement p = connection.prepareStatement("INSERT INTO users(login, email, password_digest, first_name, last_name) VALUES (?, ?, ?, ?, ?)");
			p.setString(1, user.getLogin());
			p.setString(2, user.getEmail());
			p.setString(3, passwordDigest);
			p.setString(4, user.getFirstName());
			p.setString(5, user.getLastName());
			p.executeQuery();
			p.close();
			p = connection.prepareStatement("SELECT * FROM users WHERE login = ?");
			p.setString(1, user.getLogin());
			ResultSet result = p.executeQuery();
			result.close();
			p.close();
			PreparedStatement p = connection.prepareStatement("SELECT * FROM users WHERE (login = ? OR email = ?) AND password_digest = ?");
			p.setString(1, login);
			p.setString(2, login);
			p.setString(3, passwordDigest);
			ResultSet resultUser = p.executeQuery();
			p.close();
	public User getById(int userId) {
			PreparedStatement p = connection.prepareStatement("SELECT * FROM users WHERE user_id = ?");
			p.setInt(1, userId);
			
			ResultSet resultUser = p.executeQuery();
			p.close();
	public boolean checkPasswordForUser(int userId, String password) {
			PreparedStatement p = connection.prepareStatement("SELECT * FROM users WHERE user_id = ? AND password_digest = ?");
			p.setInt(1, userId);
			p.setString(2, passwordDigest);
			ResultSet resultUser = p.executeQuery();
			p.close();
	public void changePassword(int userId, String password) {
			PreparedStatement p = connection.prepareStatement("UPDATE users SET password_digest = ? where user_id = ?");
			p.setString(1, passwordDigest);;
			p.setInt(2, userId);
			p.executeQuery();
			p.close();
	public boolean update(int userId, Double weight, Double height, Date dateOfBirth) {
			String sql = "UPDATE users SET   ";
			if (weight != null)
				sql += "weight = ?, ";
			if (height != null)
				sql += "height = ?, ";
			if (dateOfBirth != null)
				sql += "date_of_birth = ?, ";
			sql += " WHERE user_id = ?";
			PreparedStatement p = connection.prepareStatement(sql);

			int i = 1;
			if (weight != null)
				p.setDouble(i++, weight);
			if (height != null)
				p.setDouble(i++, height);
			if (dateOfBirth != null)
				p.setDate(i++, dateOfBirth);
			p.setInt(i, userId);

			play.Logger.info(sql);

			if (i > 1)
				p.executeUpdate();
			p.close();
			PreparedStatement p = connection.prepareStatement("SELECT * FROM random_strangers_of_user(?)");
			p.setInt(1, userId);
			ResultSet resultSet = p.executeQuery();
			p.close();
		List<Workout> workouts = new ArrayList<Workout>();
		Connection connection = null;
		try {
			connection = DB.getConnection();
			PreparedStatement p = connection.prepareStatement("SELECT workouts.*, gyms.gym_name "
					+ "FROM workouts "
					+ "LEFT JOIN gyms using (gym_id) "
					+ "ORDER BY workouts.finished_at DESC");
			workouts = buildWorkouts(p.executeQuery());
			p.close();
		} catch (SQLException e) {
			e.printStackTrace();
		} finally {
			if (connection != null) {
				try {
					connection.close();
				} catch (SQLException e) {
					e.printStackTrace();
				}
			}
		}
		return workouts;
		List<Workout> workouts = new ArrayList<Workout>();
		Connection connection = null;
		try {
			connection = DB.getConnection();
			PreparedStatement p = connection.prepareStatement("SELECT workouts.*, gyms.gym_name "
					+ "FROM workouts "
					+ "LEFT JOIN gyms using (gym_id) "
					+ "WHERE user_id = ? "
					+ "ORDER BY workouts.finished_at DESC");
			p.setInt(1, userId);
			workouts = buildWorkouts(p.executeQuery());
			p.close();
		} catch (SQLException e) {
			e.printStackTrace();
		} finally {
			if (connection != null) {
				try {
					connection.close();
				} catch (SQLException e) {
					e.printStackTrace();
				}
			}
		}
		return workouts;
	private List<Workout> buildWorkouts(ResultSet resultSet) {