Statement or preparedStatement

Question

Hi all guys,
Please tell me when we use Statement and when preparedStatement?
As many times we use preparedStatement so what is the use of Statement ?
And what is the advantage of using preparedStatement ? What is difference between in both ?
please reply !!!!!!!!!
amitindia
India

Answer 1

I was hoping you would ask that ;-)
Suppose your web application asks the user for their ID number. They type it into a box and click submit. This ends up calling the following method:
public List processUserID(String idNumber)
   throws SQLException
   String query = "SELECT role FROM roles WHERE id = '" + idNumber + "'";
   ResultSet rs = this.connection.executeQuery(query);
   // ... process results ...
}If out of a sense of informed malice, your user enters the following text into the ID number field:
12345'; TRUNCATE role; SELECT 'They may be able to drop the contents of your role table, because the string that ends up in "query" will be:
SELECT role FROM roles WHERE id = '12345'; TRUNCATE role; SELECT ''They have successfully injected SQL into your application that wasn't there before, hence the name. The specifics of this depend to some extent on your database, but there's some pretty portable SQL you can use to achieve this.
On the other hand, if you use a prepared statement:
public List processUserID(String idNumber)
   throws SQLException
   String query = "SELECT role FROM roles WHERE id = ?";
   PreparedStatement statement = this.connection.prepare(query);
   statement.setString(id,idNumber);
   ResultSet rs = this.connection.executeQuery(query);
   // ... process results ...
}The database is told to compile the SQL in query first. The parameter is then submitted - so whatever you put into it will never get executed as SQL (well, ok, it's possible if you're passing it as a parameter to a stored proc, but it's very unlikely) - it will just return no matching records (because there won't be any users with id "12345'; TRUNCATE role; SELECT '"
Hope that clarifies.
Dave.