Hi
All,
In
this post we will discuss about different connection
statements used in JDBC.
There are primarily three types of connection statements:-
- Statement
- PreparedStatement
- CallableStatement
Lets discuss each one of them in detail
Statement
interface :- is used to query database from Java,it provides
different methods like executeQuery(), executeUpdate() etc.
Resultset executeQuery(String) :- is used to execute SQL SELECT
queries,returns ResultSet.
Int executeUpdate(String) :- is used to execute
SQL(INSERT,UPDATE,DELETE) queries,returns int value indicating
number of rows affected
boolean
execute(String) :- returns
true if a resultSet is retrieved successfully, generally used to
execute DML statements
Statement
query gets compiled and executed every time when it is called
It
is used in case where there is no repetition of a query
Syntax
:-
statement.executeQuery("select
mail from COMPANY where name="+"'"+uName+"'");
PreparedStatement interface :-
Prepared
statement queries are precompiled and the fetch plan will be
stored in cache,so for subsequent requests only execution will
happen
They
are faster than Statement queries because Statement queries will get
compiled every time
Used
in case there is repetition of a query
Prepared
statements can be parameterized,parameterization of query values is
done by using '?' - place holder
in setXXX() method
Prepared Statement prevents SQL
injection
For
detailed explanation on SQL injection with example refer SQL injection
Syntax
:-There are two ways of using prepared statement
1.PreparedStatement
preparedStatement = connection.prepareStatement("select
* from COMPANY where sid="+"'"+emailId+"'");
2.
PreparedStatement preparedStatement =
connection.prepareStatement("select
* from COMPANY where sid=? AND name=?");
preparedStatement.setInt(1,
101);
preparedStatement.setString(2,
"Google");
setXXX()
-- takes two parameters first one tells position of the value to be
placed,
this
starts from 1 .
Second
parameter is the respective value to be passed for ?-place holder
The
first type of declaration will not prevent SQL injections because we
are hard coding the where clause with a variable.
Second
type of declaration will prevent SQL injection because all the
parameters passed will be escaped by JDBC
CallableStatement :-
Code
snippets :-
Procedure
create
or
replace
procedure "P_COMPANY"
(pname
IN
VARCHAR2, pemailid
OUT
VARCHAR2)
is
begin
select
mail into pemailid from COMPANY where
name=pname;
end;
Procedure
P_COMPANY takes two parameters and select query put the mail Id into
pemailid(OUT parameter)
//CallableStatement
usage
1
CallableStatement cs = connection.prepareCall("{call
P_COMPANY(?,?)}");
2 cs.setString(1,
name);
3 cs.registerOutParameter(2,
java.sql.Types.VARCHAR);
4 cs.execute();
5 String
mailId = cs.getString(2);
- Line
1 we are calling the the procedure P_COMPANY
- setting
the IN parameter using setString(1, name);
- registering
OUT parameter ,we have to mention sql data type also
- execute()
or executeQuery() or executeUpdate() can be used to execute the
procedure
- Line
5 getting the output from pemailid OUT variable
Complete
code
JDBCConnection.java
public
class JDBCConnection {
public
void
connectDB(String name) throws
ClassNotFoundException,
SQLException
{
Connection
connection = null;
;
CallableStatement
cs = null;
try
{
Class.forName("oracle.jdbc.driver.OracleDriver");
//
Creating connection object
connection
= DriverManager.getConnection(
"jdbc:oracle:thin:@localhost:1521:xe",
"system",
"admin");
cs
= connection.prepareCall("{call
P_COMPANY(?,?)}");
cs.setString(1,
name);
cs.registerOutParameter(2,
java.sql.Types.VARCHAR);
cs.execute();
String
mailId = cs.getString(2);
System.out.println("Required
Mail id" + mailId);
}
finally
{
try
{
connection.close();
cs.close();
}
catch
(SQLException e) {
//
TODO
Auto-generated catch block
e.printStackTrace();
}
}
}
public
static
void
main(String[] args) {
JDBCConnection
jdbc = new
JDBCConnection();
try
{
jdbc.connectDB("Yahoo");
}
catch
(ClassNotFoundException e) {
//
TODO
Auto-generated catch block
e.printStackTrace();
}
catch
(SQLException e) {
//
TODO
Auto-generated catch block
e.printStackTrace();
}
}
}
Key
Points :-
Statement
is used for non-repeating queries
Prepared
Statement will be pre-compiled,on subsequent requests the query will
get executes
Action/Execution
plan is stored in cache which helps in faster execution
Prepared
Statements will prevent SQL injections
Prepared
Statements allows parameterization of values by using place holder
[?]
Procedure
can be executed using callable interface
IN
parameter is set using setXXX()
OUT
parameter is retrived by first registering the parameter and using
getXXX()
Happy
Learning
Please
provide your valuable comments on this article and share it across
your network.