#vulnerable code 
                                public String tamper(String sqlQueryDefault) {
        
        String lead = null;
        String sqlQuery = null;
        String trail = null;
        
        Matcher matcherSql = Pattern.compile("(?s)(.*<tampering>)(.*)(</tampering>.*)").matcher(sqlQueryDefault);
        
        if (matcherSql.find()) {
            
           lead = matcherSql.group(1);
           sqlQuery = matcherSql.group(2);
           trail = matcherSql.group(3);
        }
        
        // Empty when checking character insertion
        if (StringUtils.isEmpty(sqlQuery)) {
            
            return StringUtils.EMPTY;
        }

        if (this.isHexToChar) {
            
            sqlQuery = eval(sqlQuery, TamperingType.HEX_TO_CHAR.instance().getJavascript());
        }
        
        if (this.isStringToChar) {
            
            sqlQuery = eval(sqlQuery, TamperingType.STRING_TO_CHAR.instance().getJavascript());
        }

        if (this.isFunctionComment) {
            
            sqlQuery = eval(sqlQuery, TamperingType.COMMENT_TO_METHOD_SIGNATURE.instance().getJavascript());
        }

        if (this.isVersionComment) {
            
            sqlQuery = eval(sqlQuery, TamperingType.VERSIONED_COMMENT_TO_METHOD_SIGNATURE.instance().getJavascript());
        }
        
        if (this.isEqualToLike) {
            
            sqlQuery = eval(sqlQuery, TamperingType.EQUAL_TO_LIKE.instance().getJavascript());
        }
        
        // Dependency to: EQUAL_TO_LIKE
        if (this.isSpaceToDashComment) {
            
            sqlQuery = eval(sqlQuery, TamperingType.SPACE_TO_DASH_COMMENT.instance().getJavascript());
            
        } else if (this.isSpaceToMultilineComment) {
            
            sqlQuery = eval(sqlQuery, TamperingType.SPACE_TO_MULTILINE_COMMENT.instance().getJavascript());
            
        } else if (this.isSpaceToSharpComment) {
            
            sqlQuery = eval(sqlQuery, TamperingType.SPACE_TO_SHARP_COMMENT.instance().getJavascript());
        }
        
        if (this.isRandomCase) {
            
            sqlQuery = eval(sqlQuery, TamperingType.RANDOM_CASE.instance().getJavascript());
        }
        
        if (this.isEval) {
            
            sqlQuery = eval(sqlQuery, this.customTamper);
        }
        
        if (this.isBase64) {
            
            sqlQuery = eval(sqlQuery, TamperingType.BASE64.instance().getJavascript());
        }
        
        sqlQuery = lead + sqlQuery + trail;
        
        // Include character insertion at the beginning of query
        if (this.isQuoteToUtf8) {
            
            sqlQuery = eval(sqlQuery, TamperingType.QUOTE_TO_UTF8.instance().getJavascript());
        }
        
        // Problme si le tag contient des caractres spciaux
        sqlQuery = sqlQuery.replaceAll("(?i)<tampering>", StringUtils.EMPTY);
        sqlQuery = sqlQuery.replaceAll("(?i)</tampering>", StringUtils.EMPTY);
        
        return sqlQuery;
    } 
                            #location 44 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                                public String tamper(String sqlQueryDefault) {
        
        String lead = null;
        String sqlQuery = null;
        String trail = null;
        
        // Transform only SQL query without HTTP parameters and syntax changed, like p=1'+[sql]
        Matcher matcherSql = Pattern.compile("(?s)(.*<tampering>)(.*)(</tampering>.*)").matcher(sqlQueryDefault);
        
        if (matcherSql.find()) {
            
           lead = matcherSql.group(1);
           sqlQuery = matcherSql.group(2);
           trail = matcherSql.group(3);
        }
        
        if (this.isEval) {
            
            sqlQuery = eval(sqlQuery, this.customTamper);
        }

        if (this.isRandomCase) {
            
            sqlQuery = eval(sqlQuery, TamperingType.RANDOM_CASE.instance().getJavascript());
        }
        
        if (this.isEqualToLike) {
            
            sqlQuery = eval(sqlQuery, TamperingType.EQUAL_TO_LIKE.instance().getJavascript());
        }
        
        sqlQuery = lead + sqlQuery + trail;
        
        sqlQuery = sqlQuery.replaceAll("(?i)<tampering>", StringUtils.EMPTY);
        sqlQuery = sqlQuery.replaceAll("(?i)</tampering>", StringUtils.EMPTY);
        
        // Empty when checking character insertion
        if (StringUtils.isEmpty(sqlQuery)) {
            
            return StringUtils.EMPTY;
        }
        
        // Transform all query, SQL and HTTP

        if (this.isHexToChar) {
            
            sqlQuery = eval(sqlQuery, TamperingType.HEX_TO_CHAR.instance().getJavascript());
        }
        
        if (this.isStringToChar) {
            
            sqlQuery = eval(sqlQuery, TamperingType.STRING_TO_CHAR.instance().getJavascript());
        }

        if (this.isFunctionComment) {
            
            sqlQuery = eval(sqlQuery, TamperingType.COMMENT_TO_METHOD_SIGNATURE.instance().getJavascript());
        }

        if (this.isVersionComment) {
            
            sqlQuery = eval(sqlQuery, TamperingType.VERSIONED_COMMENT_TO_METHOD_SIGNATURE.instance().getJavascript());
        }
        
        // Dependency to: EQUAL_TO_LIKE
        if (this.isSpaceToDashComment) {
            
            sqlQuery = eval(sqlQuery, TamperingType.SPACE_TO_DASH_COMMENT.instance().getJavascript());
            
        } else if (this.isSpaceToMultilineComment) {
            
            sqlQuery = eval(sqlQuery, TamperingType.SPACE_TO_MULTILINE_COMMENT.instance().getJavascript());
            
        } else if (this.isSpaceToSharpComment) {
            
            sqlQuery = eval(sqlQuery, TamperingType.SPACE_TO_SHARP_COMMENT.instance().getJavascript());
        }
        
        if (this.isBase64) {
            
            sqlQuery = eval(sqlQuery, TamperingType.BASE64.instance().getJavascript());
        }
        
        // Include character insertion at the beginning of query
        if (this.isQuoteToUtf8) {
            
            sqlQuery = eval(sqlQuery, TamperingType.QUOTE_TO_UTF8.instance().getJavascript());
        }
        
        return sqlQuery;
    }