Path: csiph.com!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail From: Martin Gregorie Newsgroups: comp.lang.java.programmer Subject: Re: Which databases are the most used with Java Date: Tue, 15 Aug 2017 10:25:48 -0000 (UTC) Organization: A noiseless patient Spider Lines: 28 Message-ID: References: <87y3qovwjb.fsf@munus.decebal.nl> <87tw1bx2c9.fsf@munus.decebal.nl> <87a833wzcx.fsf@munus.decebal.nl> <87pobz9yv5.fsf@munus.decebal.nl> <87h8x9pfi8.fsf@munus.decebal.nl> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Injection-Date: Tue, 15 Aug 2017 10:25:48 -0000 (UTC) Injection-Info: mx02.eternal-september.org; posting-host="56e792173dfa83fd3f89af287a843a15"; logging-data="19745"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX18Ktygd86miDhogppga83Cj3nsumYwOAIQ=" User-Agent: Pan/0.141 (Tarzan's Death; 168b179 git.gnome.org/pan2) Cancel-Lock: sha1:oKARknGZn7VRz4UbWTmf7VEaLgQ= Xref: csiph.com comp.lang.java.programmer:37231 On Tue, 15 Aug 2017 07:27:27 +0200, Cecil Westerhof wrote: > That is certainly interesting, but that extends PreparedStatement, not > Statement. > Slightly OT, but PreparedStatement() is to be preferred to Statement.execute() especially if any part of the SQL query originates outside the application executing it. There are two reasons for this: - since some RDBMS allow the execution plan for a query to be calculated and stored for future use by PreparedStatement, using it is likely to be more efficient if the query will be run more than once with different parameters, i.e. the values used to select rows, create new rows or amend row content. - Using a prepared statement prevents SQL injection attacks from succeeding because all externally supplied input is strictly constrained to be used as field values and, no matter how it is constructed, cannot subvert the structure of the query. IOW, it prevents 'Little Bobby Tables' exploits. See https://xkcd.com/327/ if you don't recognise the reference. -- martin@ | Martin Gregorie gregorie. | Essex, UK org |