1
JavaIntermediate#jdbc
JavaBeginner#jdbc
What is the difference between Statement and PreparedStatement?
Statement executes raw SQL strings and is vulnerable to SQL injection when concatenating user input. PreparedStatement precompiles parameterized SQL, improving performance for repeated execution and preventing SQL injection via safe parameter binding.
Example
PreparedStatement ps = conn.prepareStatement("SELECT * FROM users WHERE id = ?");
ps.setInt(1, userId);
ResultSet rs = ps.executeQuery();