Put string into preparedStatement

Question

I know that using Statement and plain String is bad programming, and I need to use preparedStatement to avoid SQL Injections. But can I create string and then put the String into preparedStatement, or is this same as using Statement ?

for example:

String sql = "SELECT * FROM users WHERE user_ID = ?";

preparedStatement = connection.prepareStatement(sql);

preparedStatement.setLong(1, userId);

It is unclear what you are asking, and I don't see how the code shown illustrates your question. — Mark Rotteveel, Nov 14 '16 at 09:41

score 2 · Answer 1 · answered Nov 14 '16 at 04:13

2

You can use ps.setString, it is not the same as using a raw String query. The PreparedStatement is guaranteed to escape characters before sending them to the database, and your query should be immune to sql injection attacks (from that String anyway).

answered Nov 14 '16 at 04:13

Elliott Frisch

183,598
16
131
226

score 0 · Answer 2 · edited May 23 '17 at 10:30

The idea is to use the parameters given as input into your PreparedStatement as is instead of building your SQL commands, in such a case the following works just fine:

PreparedStatement ps = connection.prepareStatement(sql);
ps.setString(`INPUT PARAMETER`);

If you don't abide by this, you are still VULNERABLE to SQL Injection attacks as you would be ending up concatenating strings.

Good Reads on this topic are these links:

Put string into preparedStatement

2 Answers2