title: Resolving Database Stored XSS issues from Checkmarx
body: <p>Here I am getting Error at the <code>List&lt;Data&gt; dataList = jdbcTemplate.query</code> location.</p>
  
  <p>Checkmarx says:</p>
  
  <blockquote>
    <p>AppServices/src/main/java/com/mbusa/app/dao/impl/AppRequestDAOImpl.java
    gets data from the database, for the query element. This element’s
    value then flows through the code without being properly filtered or
    encoded and is eventually displayed to the user in method
    getRequestDetail at line 117 of
    AppWeb/src/main/java/com/mbusa/app/controllers/AppRequestController.java.
    This may enable a Stored Cross-Site-Scripting attack.</p>
  </blockquote>
  
  <pre><code>List&lt;Data&gt; dataList = jdbcTemplate.query(new PreparedStatementCreator() {
  
                  @Override
                  public PreparedStatement createPreparedStatement(Connection conn) throws SQLException {
                      PreparedStatement pstmt = conn.prepareStatement(fSQL);
                      int index = 1;
                      for(Object param: effParams) {
                          pstmt.setString(index, (String) param);
                          index++;
                      }
                      return pstmt;
                  }
              }, new RequestMapper());
  
  public class RequestMapper implements RowMapper&lt;Data&gt; {
  
      @Override
      public Data mapRow(ResultSet rs, int rowNum) throws SQLException {
          Data data = new Data();
          data.setName(rs.getString("name"));
          return data ;
      }
  
  
  }
  </code></pre>
  
  <p>I have added <code>PreparedStatement</code> here to resolve this issue and also tried adding <code>HtmlUtil.htmlEscape</code> upon output data, but still could not resolve this issue.</p>
  
  <p>Can anyone help with this issue?</p>