Building the SQL string

Question

Hi, i stumbled over the following while developing my application. As we all know, it's not a good idea to do the following
String sql = "insert into mytable values ('";
sql += object.getStringValue1() + "','";
sql += object.getStringValue2() + "','";
// more...instead we should do it like this
StringBuffer sql = "insert into mytable values ('";
sql.append(object.getStringValue1()).append("',");
sql.append(object.getStringValue2()).append("',");
// more...If you agree so far, my question now: on how many appends is it worth the effort? I mean, it's clear to me, that i would use StringBuffer when appending many strings. But should i use StringBuffer to append two strings? Three strings?
Has anybody come up with some experience in this field?
Thanks in advance for your comments.
Markus

Answer 1

For me it's not worth the effort to do either of those things. Instead, I use this:String sql = "insert into mytable values (?,?,?,?,?)";
PreparedStatement ps = conn.prepareStatement(sql);and later in the program:ps.setString(1, object.getStringValue1());
ps.setString(2, object.getStringValue2());
// more...
ps.executeQuery();You only have to create the PreparedStatement once and you can reuse it as often as you like. Don't close it until you don't need to use it any more.