as far as I understand a "normal" JDBC Statement which is created via


is prone to SQL-Injection. A prepared statement protects from such attacks. So why/when should I use a normal statement and when a prepared statement.

Or the other way around: If Statement is attackable why not always use prepated statements?

Thanks and regards

  • Is a good practice to use always prepared statements I think. – OscarAkaElvis Dec 10 '16 at 13:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.