Language: Java
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    protected void writeLiteral(Object literal) throws IOException {
        if (literal == null) {
            out.write("NULL");
        } else if (literal instanceof Number || literal instanceof Boolean) {
            out.write(String.valueOf(literal));
        } else if (literal instanceof java.sql.Date || literal instanceof java.sql.Timestamp) {
            // java.sql.date toString declares to always format to yyyy-mm-dd
            // (and TimeStamp uses a similar approach)
            out.write("'" + literal + "'");
        } else if (literal instanceof java.util.Date) {
            // get back to the previous case
            Timestamp ts = new java.sql.Timestamp(((Date) literal).getTime());
            out.write("'" + ts + "'");
        } else if (literal instanceof Instant) {
            java.util.Date date = ((Instant) literal).getPosition().getDate();
            Timestamp ts = new java.sql.Timestamp(date.getTime());
            out.write("'" + ts + "'");
        } else if (literal.getClass().isArray()) {
            // write as a SQL99 array
            out.write("ARRAY[");
            int length = Array.getLength(literal);
            for (int i = 0; i < length; i++) {
                writeLiteral(Array.get(literal, i));
                if (i < length - 1) {
                    out.write(", ");
                }
            }
            out.write("]");
        } else {
            // we don't know the type...just convert back to a string
            String encoding = Converters.convert(literal, String.class, null);
            if (encoding == null) {
                // could not convert back to string, use original l value
                encoding = literal.toString();
            }

            // sigle quotes must be escaped to have a valid sql string
            String escaped = encoding.replaceAll("'", "''");
            out.write("'" + escaped + "'");
        }
    }