java - When should we use a PreparedStatement instead of a Statement? -


i know advantages of using preparedstatement, are

  • query rewritten , compiled database server
  • protection against sql injection

but want know when use instead of statement?

  1. query rewritten , compiled database server

    if don't use prepared statement, database server have parse, , compute execution plan statement each time run it. if find you'll run same statement multiple times (with different parameters) worth preparing statement once , reusing prepared statement. if querying database adhoc there little benefit this.

  2. protected against sql injection

    this advantage want hence reason use preparedstatement everytime. consequence of having parameterize query make running lot safer. time can think of not useful if allowing adhoc database queries; might use statement object if prototyping application , quicker you, or if query contains no parameters.


Comments

Popular posts from this blog

List<T>().Add problem C# -

Javascript natural sort array/object and maintain index association -