The difference between Statement and PreparedStatement
Statement is that SQL commands are passed during execution. The advantage of this is that
a Statement object can execute different SQL commands. The disadvantage is that you cannot
dynamically bind parameters.
PreparedStatement is a "precompiled" Statement, which is an extension of Statement.
It specifies the SQL command when it is created. The advantage of this is that the
SQL command can be sent to the database for precompiling at the beginning, and parameters can be dynamically bound .
Statement is that SQL commands are passed during execution. The advantage of this is that
a Statement object can execute different SQL commands. The disadvantage is that you cannot
dynamically bind parameters.
PreparedStatement is a "precompiled" Statement, which is an extension of Statement.
It specifies the SQL command when it is created. The advantage of this is that the
SQL command can be sent to the database for precompiling at the beginning, and parameters can be dynamically bound .
Therefore, it is most suitable for executing isomorphic SQL commands.
who is better and who is worse.
Using PreparedStatement can also prevent SQL injection technology,
which can effectively reduce illegal attacks.