oracle jdbc programming(preaparedstatement setXXX vs inline sql) 1

[lovekang]

case 1.
PreparedStatement pstmt = conn.getPreparedStatement();
pstmt.setString(1,"john");

case 2.
String sql = "select * from emp where user_id = '" +"john"+"'";

in the cases above, performance is segnificant ?

 

[feherke]

Hi

If you have to execute the SQL command more then once, prepared statements are certainly faster. But it is always a good idea to use [tt]PreparedStatement[/tt], because your second code is vulnerable to SQL injection. ( Unless you do not take care of it other way. ) By handling [tt]String[/tt]s with [tt]PreparedStatement[/tt] you reduce the possibility to run into character set mismatch problems.

Just some quickly picked ideas.

Feherke.

http://rootshell.be/~feherke/