Which JDBC class is used to execute parameterized SQL queries securely?

Which JDBC class is used to execute parameterized SQL queries securely?

• A. PreparedStatement
• B. Statement
• C. CallableStatement
• D. ResultSet

Answer: (A)

Parameterized queries are executed securely by separating the SQL structure from the data being inserted, so the data cannot change how the query is interpreted. The best choice for this is using a PreparedStatement. It allows you to write SQL with placeholders, like ?, and then bind values with setter methods (for example, setInt or setString). This binding sends the data separately from the SQL itself, which prevents user-supplied input from altering the query in ways that could lead to SQL injection. It also lets the database precompile the statement and reuse that execution plan, which can improve performance for repeated queries. In contrast, a plain Statement builds the full SQL string by concatenating input, which is error‑prone and vulnerable to injection if the input isn’t perfectly sanitized. A CallableStatement is for calling stored procedures, which is a related but different use case, not the general approach to parameterized queries. A ResultSet isn’t used to execute queries at all; it represents the data returned by a query.

Parameterized queries are executed securely by separating the SQL structure from the data being inserted, so the data cannot change how the query is interpreted. The best choice for this is using a PreparedStatement. It allows you to write SQL with placeholders, like ?, and then bind values with setter methods (for example, setInt or setString). This binding sends the data separately from the SQL itself, which prevents user-supplied input from altering the query in ways that could lead to SQL injection. It also lets the database precompile the statement and reuse that execution plan, which can improve performance for repeated queries.

In contrast, a plain Statement builds the full SQL string by concatenating input, which is error‑prone and vulnerable to injection if the input isn’t perfectly sanitized. A CallableStatement is for calling stored procedures, which is a related but different use case, not the general approach to parameterized queries. A ResultSet isn’t used to execute queries at all; it represents the data returned by a query.