preparedstatment 和statement的区别

preparedstatment 和statement的区别

执行静态SQL语句。通常通过Statement实例实现。
　　执行动态SQL语句。通常通过PreparedStatement实例实现。

　　Statement 每次执行sql语句，数据库都要执行sql语句的编译 ，最好用于仅执行一次查询并返回结果的情形，效率高于PreparedStatement。

　　PreparedStatement是预编译的，使用PreparedStatement有几个好处：
　　a. 在执行可变参数的一条SQL时，PreparedStatement比Statement的效率高，因为DBMS预编译一条SQL当然会比多次编译一条SQL的效率要高。
　　b. 安全性好，有效防止Sql注入等问题。
　　c. 对于多次重复执行的语句，使用PreparedStament效率会更高一点，并且在这种情况下也比较适合使用batch。
　　d. 代码的可读性和可维护性。

prepared statement in database management systems, a prepared statement or parameterized statement is a feature used to execute the same or similar database statements repeatedly with high efficiency. typically used with sql statements such as queries or updates, the prepared statement takes the form of a template into which certain constant values are substituted during each execution. 以上来源于: wikipedia statement n-count a printed document showing how much money has been paid into and taken out of a bank or investment account is called a statement. 结算清单 例： ...the address at the top of your monthly statement. …你的月结算清单顶端的地址。