PreparedStatement interface

PreparedStatement objects are compiled and prepared only once by jdbc.
- The future invocation of the PreparedStatement object does not recompile the SQL statements.
What does this statement mean ? Does it mean that incase of Statement objects the query gets compiled each time even if there is no change in the query ? Am just trying to understand the difference between Statement and PreparedStatement.

Note that not all JDBC drivers actually implement the pre-compilation feature of PreparedStatements, but that shouldn't really bother you because that feature is transparent to the developer (i.e. you shouldn't notice if it works or not).
If it works, it means that the SQL statement is parsed and interpreted only once and stored in some pre-compiled state to be reused on subsequent invocations.
But in my opinion that is not the most important feature of PreparedStatements. Much more important is the ability to specify values using parameters without having to convert them to the correct SQL string representation. This is the simplest way to protect against [SQL injection attacks|http://en.wikipedia.org/wiki/SQL_injection].

Similar Messages

Why resultset is interface

Hi all,
In JDBC, statement, Resultset, CallableStatement, PreparedStatement interfaces there.
My question is, why they are interfaces but not classes.
If anybody knows, pl. answer to my question.
Thanx and regrads,
srinivas

They are interfaces because they need to be implemented differently (possibly) by each creator of a JDBC driver. The class that does the work for a PreparedStatement in the Sun ODBC-JDBC driver is not the same one that does the work for a PreparedStatement for the Oracle thin client driver.

How to upload size 4k file to oracle BLOB field

hi all, i'm using Oracle 9i, Orcale JDBC thin Driver and ibm websphere to develop a java application.i have used java EJB/CMP to insert images into BLOB field in oracle.
i used byte[] mapping to BLOB.i did it successfully.
however, i'm facing another problem. it is that
when i insert files larger than 4k, there is exception error. it said that the inserted value is too large.
is that the problem of orcale JDBC?
is that any solution to solve this restriction?
it is very urgent, pls help!
thx a lot

Hi Lee
Thanks for ur valuable suggestions. Please give me
more idea i would really thank to u !Which part is giving you troubles?
Oh - and change my suggestion to use setBinaryStream to a suggestion to use setAsciiStream, as I missed the part where you said "text file".
>
Can anybody tell me anyother way how to solv thid
problem
Depending on the size of the text file you could just read the file so you have the contents as a String and use setString (also in the PreparedStatement interface).
hanks
Message was edited by:
MerlinRosina

Login using java beans

hey got another problem with jsp
any experts can teach me how to add javabeans into this jsp.
and anyway, this code doesnt work perfectly.
when i keyed in the username n password i created in the CarRental-Login database, (uname=2222,pwd=2222)
it gives me invalid username or password.
wat actually went wrong?
thank ya in advance..
the codes i had is as follows..
<%@ page import = "java.sql.*" %>
<%@ page import = "java.util.*" %>
<HTML>
<HEAD>
<TITLE> LOGIN </TITLE>
</HEAD>
<BODY>
<% String user = request.getParameter("user"); %>
<% String pwd = request.getParameter("pwd"); %>
<%
try
//load the JDBC driver
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
//open a connection to the "CarRental" database
Connection connection= DriverManager.getConnection("jdbc:odbc:CarRental","","");
//create a statement object for sending SQL queries
Statement statement = connection.createStatement();
String queryLogin = "SELECT Username, Password FROM Login WHERE Username = '"+user+"' AND Password = '"+pwd+"'";
//place query results in a ResultSet object
ResultSet rs = statement.executeQuery(queryLogin);
while (rs.next())
String rsUser = rs.getString("Username");
String rsPass = rs.getString("Password");
if (user.equalsIgnoreCase("rsUser") && pwd.equalsIgnoreCase("rsPass"))
out.println("<H2>Login Successful!! </H2>");
else {
out.println("<H2>Invalid username or password had entered!! <a href=\"Login.html\"> Click to continue</a></H2>");
//clean up all objects
rs.close();
statement.close();
connection.close();
catch (Exception e)
out.println(e);
%>
<H2> error in accessing database </H2>
<% } %>
</BODY>
<HTML>

dont really get u..
do u mean by deleting the quotes? i tried deleting
the double quotes, but it cant resolve symbols..Ah, yes that's because you declared those variables (rsUser, rsPass) inside your "while" loop. So move the declarations outside that loop.
dont get u for the following..
For another thing, use PreparedStatements.Read the API:
http://java.sun.com/j2se/1.4.2/docs/api/
(look for the PreparedStatement interface)
And do a JDBC tutorial (search for JDBC tutorial on this site or www.google.com, for instance)
For another thing, no need to loop thru a resultset
which can only contain either 0 or 1 item in it.Your SELECT statement should only return 0 or 1 row (either the row was found, or it wasn't), so why the "while (rs.next())" loop? Just do: "if (rs.next())"

When to use setBytes() and setBinaryStream()

Hi,
I am using oracle thin driver to insert a image (blob type) into database.
Which method of PreparedStatement interface should I use to insert data,
setBytes() or SetBinaryStream().
My understanding is BinaryStream also sends data in form of bytes.
Then what is the difference between these two method ?
Please let me know.
Thanks,
-Amol

Well... looking at the API...
public void setBytes(int parameterIndex, byte[] x)
throws SQLExceptionSets the designated parameter to the given Java array of bytes.
The driver converts this to an SQL VARBINARY or LONGVARBINARY
(depending on the argument's size relative to the driver's limits
on VARBINARY values) when it sends it to the database.
public void setBinaryStream(int parameterIndex, InputStream x,int length)
throws SQLExceptionSets the designated parameter to the given input stream, which will
have the specified number of bytes. When a very large binary value
is input to a LONGVARBINARY parameter, it may be more practical to send
it via a java.io.InputStream object. The data will be read from the
stream as needed until end-of-file is reached.
It appears that setBytes() you pass in an entire in-memory array
of bytes, whereas setBinaryStream() allows you to pass in an
InputStream that contains the bytes.

Common query method

Hi,
I need to query an oracle database using bind variables. To do so, I have a method to execute any query, that would receive the query in a "SELECT fieldFROM table WHERE id = :param1" fashion, and a list of the params for the binded variables in the where clause. This params them need to be set by its type's corresponding method, for example, ints would use the preparedStatement.setInt(index, integer) method.
I might try to receive as the parameters list an object of type List<Object> and then map the each item in the list with instance of, for every method declared in the PreparedStatement interface, like
if (parametro instanceof Short) {
statement.setShort(index, (Short) parametro);
}but surely there is a better way...
Since this would be used by any query, would you suggest to design it as a class where all related methods to execute the query, map the fields to set methods, and, transform result sets into domain objects live?
Thanks in advance.

I have fixed a template method structure where the abstract class is holding the executeQuery method, that will first call a method to prepare de query, then set the paramethers for the query and finally delegate de execute query on the preparedStatement. Both the prepareQuery and the setParameters methods are left for the extending classes to implement, so they will know what method on PreparedStatement to use to add the named variables with its right type.

Get mails from server and put into DB without allocating memory.

Hi all
I have a application that downloads the mails from the mail server and then write them to the DB.
I am using folder.getMessage method to get the mails from server.
is there a way using which I can have a function that acts as a pipe between my server and DB and write the mails without consuming the memory.
(may be something to do with getInputByteStream/getOutputByteStream or getInputStream and setBinaryStream 'preparedStatement interface ')
Thanks

Hi all
I have a application that downloads the mails from the mail server and then write them to the DB.
I am using folder.getMessage method to get the mails from server.
is there a way using which I can have a function that acts as a pipe between my server and DB and write the mails without consuming the memory.
(may be something to do with getInputByteStream/getOutputByteStream or getInputStream and setBinaryStream 'preparedStatement interface ')
Thanks

What is the difference between PreparedStament and Statment?

Hi there,
i need to know when should i use an instance of the PreparedStatment interface and when i should use the Statment interface?
please help me getting that.
thanx.

I always heard in these forums that PreparedStatements were slower, had more overhead if you only need to Query the database once(not reuse). I did some testing to try to see what the difference in performance between the Statement and PreparedStatement would be. I only tested whether the Statement is faster than PreparedStatement on a <b>single</b> query:
code for Statement:Statement s = null;
ResultSet r=null;
long before = new java.util.Date().getTime();
s = sconn.createStatement();
//simulate a dynamic query:
r=s.executeQuery("select emp_lname from emp where empID = "+"1"+" and emp_fname = '"+"Jimmy"+"'");
while (r.next())
     System.out.println(r.getString(1));
long after = new java.util.Date().getTime();
long difference = after - before;
System.out.println("difference: "+difference);PreparedStatement code:
PreparedStatement s = null;
ResultSet r=null;
String sql = "select emp_lname from emp where empID = ? and emp_fname = ?";
long before = new java.util.Date().getTime();
s = sconn.prepareStatement(sql);
//set variables
s.setInt(1,1);
s.setString(2, "Jimmy");
r=s.executeQuery();
while (r.next())
     System.out.println(r.getString(1));
long after = new java.util.Date().getTime();
long difference = after - before;
System.out.println("difference: "+difference);Results for 5 tests(duration in milliseconds):
Statement
160
270
220
220
110
PreparedStatement
220
270
160
220
110
Conclusion: based on my little experiment the performance of a single query to the database takes about the same time using either a PreparedStatement. So don't eliminate the use a PreparedStatement because you think it would be slower and have more overhead on a single query.
margin for error: pretty high :)

How OC4J handles fatal error codes

1. Does OC4j cleans/closes all connections in the connection pool when OC4J detects fatal error codes? Does OC4J really work as per oracle documentation? Can I get an example showing how is it done?
Oracle Documentation says:
For each data source defined in data-sources.xml, you can define fatal error codes that indicate that the back-end database with which the data source communicates is no longer accessible. When OC4J detects one of these error codes (stated when a SQLException is thrown by the JDBC driver), OC4J will clean its connection pool. That is, it closes all connections in the connection pool. For Oracle, the predefined fatal error codes are: 3113, 3114, 1033, 1034, 1089, and 1090.
2. When OC4J detects fatal error codes defined in an connection pool in data-sources.xml, how connections in the connection pool are handled by OC4J?
3. When OC4J detects fatal error codes on one connection to Oracle database, then will OC4J restore / close the connection back to connection pool?
4. Does OC4J really work on fatal error codes?
Sample code of connection pool I used in data-sources.xml file where I defined fatal error codes:
<connection-pool name="FSCMDS" inactivity-timeout="30" initial-limit="5" max-connections="5" validate-connection-statement="select * from dual">
<connection-factory factory-class="oracle.jdbc.pool.OracleDataSource" user="" password="" url="" commit-record-table-name="">
<proxy-interface sql-object="PreparedStatement" interface="oracle.jdbc.OraclePreparedStatement"/>
<*fatal-error-codes*>
<*error-code code="3113"*/>
</*fatal-error-codes*>
</connection-factory>
</connection-pool>
Please post answers on these questions...
Thanks
Venkat

This forum is for general database questions, post your question here:
OC4J
Werner

Regarding java.sql.PreparedStatement

hi all,
Iam using mysql as backend and working using servlets/JSP's.i have been trying to find out datatypes of fields using ParameterMetaData Interface using PreparedStatement.But iam getting an error stating that it is not implemented in com.mysql.jdbc.NotImplemented:Feature not implemented.
Here is my code
                       Class.forName("org.gjt.mm.mysql.Driver");
                Connection con=DriverManager.getConnection("jdbc:mysql://localhost/"+"uniguru","root","");
                System.out.println("con="+con);
               PreparedStatement ps = con.prepareStatement("INSERT INTO linkstable VALUES(?, ?, ?,?)");
               try
                 ParameterMetaData pmd = ps.getParameterMetaData();
                 System.out.println("pmd="+pmd);
               for (int i = 1; i < pmd.getParameterCount(); i++)
                    System.out.println("Parameter number " + i);
                    System.out.println(" Class name is " + pmd.getParameterClassName(i));
                    // Note: Mode relates to input, output or inout
                    System.out.println(" Mode is " + pmd.getParameterClassName(i));
                    System.out.println(" Type is " + pmd.getParameterType(i));
                    System.out.println(" Type name is " + pmd.getParameterTypeName(i));
                    System.out.println(" Precision is " + pmd.getPrecision(i));
                    System.out.println(" Scale is " + pmd.getScale(i));
                    System.out.println(" Nullable? is " + pmd.isNullable(i));
                    System.out.println(" Signed? is " + pmd.isSigned(i));
               catch(SQLException e)
                    System.out.println(e);
               }Iam trying to write a generic servlet so as to insert any table values.Presently iam inserting values in a table named linkstable and i need to find out the datatypes.
Thanx in advance.

Have you tried to update to a newer driver?
It's the driver that says that the feature you are trying to use isn't implemented/supported by it.
Kaj

Java.sql.PreparedStatement.setArray( ) not found in J2SE v1.3.1?

Why do I get the error method setArray(int, Array) not found in interface java.sql.PreparedStatement? As per on-line documentation the method is available since version 1.2.
In JDeveloper help I have read that...
"JDeveloper uses J2SE definitions to describe an installed J2SE environment. This environment can be either a JRE (Java Runtime Engine) or an SDK. Note that if you are using a JRE, some features may not be available. Every JDeveloper project uses a J2SE definition to determine what version of the Java API to compile and run with."
Is my problem because my JDeveloper installation is using a JRE and not an SDK?

Sounds like a SQL problem. Not an expert in DB2 bu you might want to try INSERT INTO SESSION (col1name, col2name) VALUES (?,?);
Edited by: Kungen on Sep 19, 2007 6:46 AM

PreparedStatement Error

I'm getting this error when i try submitting values from my Jsp page into a database:
Method preparedStatement(java.lang.String)not found in interface java.sql.Connection.
The arrow that appears usually beneath the code in the error 500 message suggests that the problem is occuring in the insert statement, and im thinking it does'nt like the question mark in place of the value.
Is this because im importing the wrong class? my current class string is:
@page contentType="text/html; charset=iso-8859-1" language="java" import="java.lang.string.*" import="java.sql.*"
This is what the line within the program looks like:-
quote = Connquote.preparedStatement("INSERT INTO table1(A, B, C, D, E, F, G, H, I, J, K, L, M, N) values( ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ? )");

But this gives me an error:
java.sql.SQLException:Parameter index out of range (1
number of parameters, w
If it says that it means you don't have any bind variables in your SQL.
Whah happens obj is null?Nothing to do with it. And you are writing code that is probably pointless as well. setObject() handles nulls.

PreparedStatement and 'Order by'

How can a PreparedStatement be made in this situation?
String query = " Select * from myTable where id=? Order by ? ? ";
PreparedStatement ps = con.prepareStatement( query);
ps.setInt(1,userID);
ps.setString (2, columnName );
ps.setString (3, ascOrDesc );The problem is the 3rd value. You cannot stick 2 question marks together like that. However, if I do the following it compiles, but the query doesn't place the values in order.
String query = " Select * from myTable where id=? Order by ? "+ascOrDesc;
PreparedStatement ps = con.prepareStatement( query);
ps.setInt(1,userID);
ps.setString (2, columnName );So, what to do?

Just to make the answer more clear, you cannot use the same prepared statements for ascending and descending sorts. You need one for each.
String query = " Select * from myTable where id=?
Order by ? asc ";
PreparedStatement ps = con.prepareStatement( query );
ps.setInt(1,userID);
ps.setString (2, columnName );Of course, you can refactor this into a single method, something like:
static final String MYTABLE_QUERY = "Select * from myTable where id=? Order by ?";
public String getMyTableQuerySQL( boolean isAscending )
     return MYTABLE_QUERY + ( isAscending ? " asc" : " desc" );
PreparedStatement st = con.prepareStatement( getMyTableQuerySQL( isAscending ) );Another cool thing to do (that belongs in another thread) is to wrap Connection in an envelope that implements the Connection interface and add a PreparedStatement cache. This optimally will be a PooledConnection. Here's a niave skeletal implementation:
First we'll write the statement cache we will be using. This is an LRU map using STATEMENT_CACHE_SIZE to set the max number of elements we want in the cache. I usually make this settable by a property with a default of 8.
    class StatementCache extends LinkedHashMap
        public StatementCache()
            super( STATEMENT_CACHE_SIZE, 0.75f, true );
        protected boolean removeEldestEntry( final Map.Entry eldest )
            if ( size() <= STATEMENT_CACHE_SIZE )
                return false;
            else
                final CachedPreparedStatement ps =
                    (CachedPreparedStatement)eldest.getValue();
                if ( ps.isActive() )
                    return false;
                try
                    ps.reallyClose(); // NOTE: Really close the statement
                catch ( SQLException e )
                    e.printStackTrace();
                return true;
    }Now we need to wrap PreparedStatement:
class CachedPreparedStatement implements PreparedStatement
    /** The real statement we are delegating to */
    private PreparedStatement m_statement;
    /** We change the behavior of close to just flip this switch. */
    protected boolean m_active = true;
    public CachedPreparedStatement( final String sql, final Connection con ) throws SQLException
        m_statement = con.prepareStatement( sql );
    public boolean isActive()
        return m_active;
    public boolean setActive( boolean isActive )
        m_active = isActive;
    public void close() throws SQLException
        clearParameters();
        try
            clearWarnings();
        catch ( SQLException e )
            e.printStackTrace();
        // mark it as no longer active
        setActive( false );
    public void reallyClose() throws SQLException
        setActive( false );
        m_statement.close();
    // now just delegate all the rest of the interface methods to m_statement
}Finally, we wrap Connection:
class PooledConnection extends implements Connection
    /** A map of cached statements */
    private Map m_statementCache = new StatementCache();
    /** The connection we are delegating to */
    private Connection m_connection;
    /** {@inheritDoc} */
    public PreparedStatement prepareStatement( final String sql )
        throws SQLException
        // create or fetch a cached prepared statement and activate
        final CachedPreparedStatement statement = (CachedPreparedStatement)
            m_statementCache.get( sql );
        if ( statement != null )
            statement.setActive( true );
            return statement;
        else
            // need to create a new one and cache it
            final CachedPreparedStatement ps =
                new CachedPreparedStatement( sql, m_connection );
            m_statementCache.put( sql, ps );
            return ps;
    // now just delegate the rest of the interface methods to m_connection
}The Connection class provided by your JDBC driver should close all open statements when the connection is closed. However, if you are not sure about this, you can implement #close on your Connection class to first iterate throught the cache and close each statement.

Preparedstatement and setdate

Hi,
I am using prepared statement to enter date into the table. Setdate has been giving me problems.
When I say:
pstmtAdd.setDate(i + 1, etaDate, c);
it gives me a compiler error. Here etaDate is a date field and c is a calendar. The compilor error says
Method setDate(int, java.util.Date, java.util.Calendar) not found in interface java.sql.PreparedStatement at line 115.
I have used alternates, ie setString for DB2 and setTime for Oracle to insert the data. I am sure this is a wrong approachand I am missing a simple step.
Can any one please help?
Thanks
Lakshmi
Note: I have also tried the following but only in vain
pstmtAdd.setDate(i + 1, etaDate);
where etaDate is a date field

etaDate should be java.sql.Date instead of java.util.Date as specified by you!
HTH

ARRAY using in PreparedStatement in various servers

Hello, all! I have a question.
I want to use array in my sql query and write next:
PreparedStatement ps = con.prepareStatement(MY_QUERY);
ArrayDescriptor arrayDescriptor = ArrayDescriptor.createDescriptor("CHAR_ARRAY", wrappedConection);
ARRAY myArray = new ARRAY(arrayDescriptor, con, javaArray);
ps.setArray(1, myArray);
ResultSet result = ps.executeQuery();
The problem lay in the arrayDescriptor need for OracleConnection, but I have wrapped connection from various servers. Any suggestions?

If you need a database-specific class that's outside the java.sql interface set, I'd say you're doing it wrong.
How is saving an array relational? Why wouldn't it be n records instead of 1?
%

PreparedStatement interface

Similar Messages

Maybe you are looking for