JDBC, PreparedStatement and SQL Injection
40 min · Intermediate
JDBC (Java Database Connectivity) is the standard Java API for talking to relational databases: Connection, PreparedStatement, ResultSet and friends in java.sql. Even if you use Spring Data JPA, interviewers ask JDBC basics, and SQL injection is one of the most asked security questions. Section 13 (JDBC & Database Connectivity) taught it; this lesson is the revision.
Topics in this lesson
- JDBC steps in order
- Statement vs PreparedStatement, and how SQL injection works
- try-with-resources and connection pooling
- Transactions: setAutoCommit(false), commit, rollback
- The DAO pattern
Interview questions this lesson answers
- What is JDBC?
- What are the steps to connect to a database using JDBC?
- Is Class.forName still needed to load the driver?
- What are the main JDBC interfaces?
- What is the difference between execute, executeQuery and executeUpdate?
- What is the difference between Statement and PreparedStatement?
- What is SQL injection?
- How does PreparedStatement prevent SQL injection?
- Can PreparedStatement parameters be used for table or column names?
- Besides PreparedStatement, how else do you defend against SQL injection?
Sign in free to continue this lesson
Create a free account to read every lesson, practise with the exercises and keep track of your progress.