Interacting with Networks and Databases - Beginning Java 7 - page 870

PreparedStatement
PreparedStatement isthenexteasiest-to-useinterface,and Connection 's Pre-
paredStatement prepareStatement() method is the easiest-to-use method
for obtaining a PreparedStatement instance— PreparedStatement is a
subinterface of Statement .
Unlikearegularstatement,a prepared statement representsaprecompiledSQLstate-
ment.TheSQLstatementiscompiledtoimproveperformanceandpreventSQLinjec-
tion(see http://en.wikipedia.org/wiki/SQL_injection ),andthecom-
piled result is stored in a PreparedStatement implementation instance.
Youtypicallyobtainthisinstancewhenyouwanttoexecutethesamepreparedstate-
ment multiple times (e.g., you want to execute an SQL INSERT statement multiple
times to populate a database table). Consider the following example:
sql = "INSERT INTO EMPLOYEES VALUES(?, ?)";
try (PreparedStatement pstmt = con.prepareStatement(sql))
{
String[] empNames = {"John Doe", "Sally Smith"};
for (int i = 0; i < empNames.length; i++)
{
pstmt.setInt(1, i+1);
pstmt.setString(2, empNames[i]);