Executing Queries: Statement vs PreparedStatement (SQL Injection Prevention)0%

ResultSet Navigation and Mapping Rows to Java Domain Models

Executing Queries: Statement vs PreparedStatement (SQL Injection Prevention)

Advanced16 min read•Updated: 2025-01-15

🛡️ Executing Queries: Statement vs PreparedStatement (SQL Injection Prevention)

Introduction

When executing SQL statements in JDBC, Java provides two primary interfaces: Statement and PreparedStatement. In production enterprise applications, PreparedStatement is universally mandated because it eliminates catastrophic SQL Injection attacks and delivers superior query performance.

🚨 The Vulnerability: Raw `Statement` and SQL Injection

Consider a login validation query built with string concatenation:

1// ❌ CRITICAL SECURITY VULNERABILITY!
2String rawSql = "SELECT * FROM users WHERE username = '" + userInputUser + 
3                "' AND password = '" + userInputPass + "'";
4Statement stmt = connection.createStatement();
5ResultSet rs = stmt.executeQuery(rawSql);

If an attacker inputs:

1Username: admin' OR '1'='1
2Password: anything

The query evaluated by the SQL engine becomes:

1SELECT * FROM users WHERE username = 'admin' OR '1'='1' AND password = 'anything'

The condition '1'='1' evaluates to true, granting unauthorized administrative bypass to your entire platform!

🛡️ The Defense: `PreparedStatement` with Parameter Placeholders (`?`)

With PreparedStatement, the database pre-compiles the query template before values are supplied. User input is treated strictly as literal data, never as executable SQL commands:

1String safeSql = "SELECT * FROM users WHERE username = ? AND password = ?";
2 
3try (PreparedStatement pstmt = connection.prepareStatement(safeSql)) {
4    // Bind parameters by 1-based index:
5    pstmt.setString(1, userInputUser);
6    pstmt.setString(2, userInputPass);
7 
8    try (ResultSet rs = pstmt.executeQuery()) {
9        if (rs.next()) {
10            System.out.println("Authenticated as: " + rs.getString("full_name"));
11        } else {
12            System.out.println("Invalid credentials.");
13        }
14    }
15}

📊 Summary Comparison

Feature	`Statement`	`PreparedStatement`
SQL Injection Defense	Vulnerable (manual escaping needed)	100% Immune (driver parameterization)
Query Plan Caching	Re-parsed and re-compiled every time	Pre-compiled once, re-executed fast
Batch Updates	Inefficient	Highly optimized with batch binding
Binary Data (BLOBs)	Difficult to handle	Seamless via `setBinaryStream()`

Next Lesson

ResultSet Navigation and Mapping Rows to Java Domain Models

Continue learning with hands-on practice, examples, and exercises in the upcoming topic.

Related Lessons

Previous Lesson	Next Lesson
JDBC Architecture, Drivers, and DriverManager Connection	ResultSet Navigation and Mapping Rows to Java Domain Models

Practice Quiz

Test your understanding of this lesson with 1 questions. Each question has one correct answer.

Previous Next

PreviousPrevNext

MSK Institute • Shikohabad

Loading Page Content...

Preparing courses, live labs, and learning resources.सामग्री लोड हो रही है, कृपया प्रतीक्षा करें...

Connecting serverPlease wait...

💻 Practical Labs🚀 Free Demo📜 Verified Certificates

🚨 The Vulnerability: Raw Statement and SQL Injection

Consider a login validation query built with string concatenation:

1// ❌ CRITICAL SECURITY VULNERABILITY!
2String rawSql = "SELECT * FROM users WHERE username = '" + userInputUser + 
3                "' AND password = '" + userInputPass + "'";
4Statement stmt = connection.createStatement();
5ResultSet rs = stmt.executeQuery(rawSql);

If an attacker inputs:

1Username: admin' OR '1'='1
2Password: anything

The query evaluated by the SQL engine becomes:

1SELECT * FROM users WHERE username = 'admin' OR '1'='1' AND password = 'anything'

The condition '1'='1' evaluates to true, granting unauthorized administrative bypass to your entire platform!

🛡️ The Defense: PreparedStatement with Parameter Placeholders (?)

With PreparedStatement, the database pre-compiles the query template before values are supplied. User input is treated strictly as literal data, never as executable SQL commands:

1String safeSql = "SELECT * FROM users WHERE username = ? AND password = ?";
2 
3try (PreparedStatement pstmt = connection.prepareStatement(safeSql)) {
4    // Bind parameters by 1-based index:
5    pstmt.setString(1, userInputUser);
6    pstmt.setString(2, userInputPass);
7 
8    try (ResultSet rs = pstmt.executeQuery()) {
9        if (rs.next()) {
10            System.out.println("Authenticated as: " + rs.getString("full_name"));
11        } else {
12            System.out.println("Invalid credentials.");
13        }
14    }
15}

📊 Summary Comparison

Feature	`Statement`	`PreparedStatement`
SQL Injection Defense	Vulnerable (manual escaping needed)	100% Immune (driver parameterization)
Query Plan Caching	Re-parsed and re-compiled every time	Pre-compiled once, re-executed fast
Batch Updates	Inefficient	Highly optimized with batch binding
Binary Data (BLOBs)	Difficult to handle	Seamless via `setBinaryStream()`

Previous Lesson

Next Lesson

JDBC Architecture, Drivers, and DriverManager Connection

ResultSet Navigation and Mapping Rows to Java Domain Models

🛡️ Executing Queries: Statement vs PreparedStatement (SQL Injection Prevention)

Introduction

🚨 The Vulnerability: Raw Statement and SQL Injection

🛡️ The Defense: PreparedStatement with Parameter Placeholders (?)

📊 Summary Comparison

ResultSet Navigation and Mapping Rows to Java Domain Models

Related Lessons

Practice Quiz

Loading Page Content...

🛡️ Executing Queries: Statement vs PreparedStatement (SQL Injection Prevention)

Introduction

🚨 The Vulnerability: Raw Statement and SQL Injection

🛡️ The Defense: PreparedStatement with Parameter Placeholders (?)

📊 Summary Comparison

ResultSet Navigation and Mapping Rows to Java Domain Models

Related Lessons

Practice Quiz

🚨 The Vulnerability: Raw `Statement` and SQL Injection

🛡️ The Defense: `PreparedStatement` with Parameter Placeholders (`?`)

🚨 The Vulnerability: Raw `Statement` and SQL Injection

🛡️ The Defense: `PreparedStatement` with Parameter Placeholders (`?`)