Is SQL injection possible in the below code? String username = request.getParameter(“username”); String password = request.getParameter(“password”); conn = pool.getConnection( ); PreparedStatement pstmt = conn.prepareStatement(“select * from user where username=”+username+” and password=”+password); pstmt.execute(); rs = pstmt.getResultSet();

SQL injection is possible because despite using PreparedStatement, the code concatenates username and password directly into the query string instead of using parameter placeholders (?). The vulnerability is in the statement: "...where username="+username+" and password="+password. An attacker could input ' OR '1'='1 as password to bypass authentication. PreparedStatement only prevents SQLi when used with setString() on placeholders.