Language: Java
Label: vulnerable
CWE: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Code:
    public Object visit(Id filter, Object extraData) {
        if (primaryKey == null) {
            throw new RuntimeException("Must set primary key before trying to encode FIDFilters");
        }

        Set ids = filter.getIdentifiers();

        LOGGER.finer("Exporting FID=" + ids);
        try {
            if (ids.size() > 1) {
                out.write("(");
            }
            List<PrimaryKeyColumn> columns = primaryKey.getColumns();
            for (Iterator i = ids.iterator(); i.hasNext(); ) {
                Identifier id = (Identifier) i.next();
                List<Object> attValues = JDBCDataStore.decodeFID(primaryKey, id.toString(), false);

                out.write("(");

                for (int j = 0; j < attValues.size(); j++) {
                    // in case of join the pk columns need to be qualified with alias
                    if (filter instanceof JoinId) {
                        out.write(escapeName(((JoinId) filter).getAlias()));
                        out.write(".");
                    }
                    out.write(escapeName(columns.get(j).getName()));
                    out.write(" = '");
                    out.write(
                            attValues.get(j).toString()); // DJB: changed this to attValues[j] from
                    // attValues[i].
                    out.write("'");

                    if (j < (attValues.size() - 1)) {
                        out.write(" AND ");
                    }
                }

                out.write(")");

                if (i.hasNext()) {
                    out.write(" OR ");
                }
            }
            if (ids.size() > 1) {
                out.write(")");
            }
        } catch (java.io.IOException e) {
            throw new RuntimeException(IO_ERROR, e);
        }

        return extraData;
    }