I am currently deving a java application using spring data JPA, postGIS, Hibernate, and geoTools. I have a controller GET method that takes in a query string as a parameter to be used to determine if Point objects in my data base are within the specified area passed in with the GET call. My happy path goes as follows: Get request is made -> query string is a GeoJson -> controller sends that string to a service level -> service level calls repository -> repository uses Spring data JPA to perform this query:
SELECT * FROM Shop WHERE st_within(shop.point_geom, st_setsrid(st_geomfromgeojson(:input), 4326)) = TRUE
now this works fine and dandy, and I am now in the testing phase. What I am trying to test currently is whether or not this query is safe from SQL injection. The only info I can find on the web when researching geomFromGeoJson and sql injection is over a node.js ORM library. So would anyone with java and postGIS experience be willing to send me in the right direction?