CWE-669: Incorrect Resource Transfer Between Spheres

<form action="FileUploadServlet" method="post" enctype="multipart/form-data">                      Choose a file to upload:<input type="file" name="filename"/><br/><input type="submit" name="submit" value="Submit"/>                      </form>

public class FileUploadServlet extends HttpServlet {                                               ...                            protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {                                                           response.setContentType("text/html");PrintWriter out = response.getWriter();String contentType = request.getContentType();                                  // the starting position of the boundary headerint ind = contentType.indexOf("boundary=");String boundary = contentType.substring(ind+9);                                  String pLine = new String();String uploadLocation = new String(UPLOAD_DIRECTORY_STRING); //Constant value                                  // verify that content type is multipart form dataif (contentType != null && contentType.indexOf("multipart/form-data") != -1) {                                                                       // extract the filename from the Http headerBufferedReader br = new BufferedReader(new InputStreamReader(request.getInputStream()));...pLine = br.readLine();String filename = pLine.substring(pLine.lastIndexOf("\\"), pLine.lastIndexOf("\""));...                                        // output the file to the local upload directorytry {                                           BufferedWriter bw = new BufferedWriter(new FileWriter(uploadLocation+filename, true));for (String line; (line=br.readLine())!=null; ) {if (line.indexOf(boundary) == -1) {bw.write(line);bw.newLine();bw.flush();}} //end of for loopbw.close();                                                                                                                        } catch (IOException ex) {...}// output successful upload response HTML page                                  }// output unsuccessful upload response HTML pageelse{...}                            }...                                               }

//assume the password is already encrypted, avoiding CWE-312                                            function authenticate($username,$password){                         include("http://external.example.com/dbInfo.php");                                                  //dbInfo.php makes $dbhost, $dbuser, $dbpass, $dbname available                         mysql_connect($dbhost, $dbuser, $dbpass) or die ('Error connecting to mysql');mysql_select_db($dbname);$query = 'Select * from users where username='.$username.' And password='.$password;$result = mysql_query($query);                         if(mysql_numrows($result) == 1){mysql_close();return true;}else{mysql_close();return false;}                      }

// API flag, output JSON if set                      $json = $_GET['json']$username = $_GET['user']if(!$json){                         $record = getUserRecord($username);foreach($record as $fieldName => $fieldValue){                               if($fieldName == "email_address") {                                                                                                                     // skip displaying user emails                                        continue;                                  }else{writeToHtmlPage($fieldName,$fieldValue);}                            }                      }else{$record = getUserRecord($username);echo json_encode($record);}