as far as I understand a "normal" JDBC Statement which is created via
is prone to SQL-Injection. A prepared statement protects from such attacks. So why/when should I use a normal statement and when a prepared statement.
Or the other way around: If Statement is attackable why not always use prepated statements?
Thanks and regards