如何在不同的请求中发送sql查询的参数？

Question

PostgreSQL 9.4

As known, JDBC- PreparedStatement can prevent sql-injection attack by sending parameters in a query different from one that is used for sending the actual query's body.

How can I send such two queries to a database directly or it doesn't supported by RDBMS ? I mean, does preparedStatement do its internal magic and send the queries parameters in the different query, or RDBMS s support that natively?

Answer 1

prepareStatement does not contain different values of parameters but only placeholders (marked with ?)

 con.prepareStatement("select cu_id, cu_last_name from customer where cu_id between ? and ?")

The placeholders (bind variables) are set before the execution to required values

 stmt.setInt(1,100)
 stmt.setInt(2,105)

and the query is executed

 stmt.executeQuery()

The important fact is, that the dababase can reuse the statement for more execution, so the statement is not parsed completely for each execution (but details depend on DBMS), which can provide better performance. The SQL injection is prevented due to the fact that only parameter value is provided - it is not possible to change the SQL query text.