import java.sql.*;

class SqlInjection {

	ResultSet f(Connection conn, String query) throws Exception {
		Statement statement = conn.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
				ResultSet.CONCUR_READ_ONLY);
		return statement.executeQuery(query);
	}

	ResultSet g(Connection conn) throws Exception {
		Statement statement = conn.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
				ResultSet.CONCUR_READ_ONLY);
		return statement.executeQuery("FOOBAR");
	}

	ResultSet h(Connection conn, String name) throws Exception {
		Statement statement = conn.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,
				ResultSet.CONCUR_READ_ONLY);
		return statement.executeQuery("FOO '" + name + "'");
	}
}

@@ -35,16 +35,76 @@
 tion %7B%0A%0A
+%09static final String tableName = System.getProperty(%22XXX%22);%0A
 %09ResultS
@@ -518,24 +518,263 @@
 FOOBAR%22);%0A%09%7D
+%0A%09ResultSet g2(Connection conn) throws Exception %7B%0A%09%09Statement statement = conn.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,%0A%09%09%09%09ResultSet.CONCUR_READ_ONLY);%0A%09%09return statement.executeQuery(%22FOOBAR where x = '%22 + tableName + %22'%22);%0A%09%7D
 %0A%0A%09ResultSet

add test case where we are appending string constants and static fields (considered to be lower priority)