Parameterized SQL Statements

Owned by Sherif Koussa
Jan 09, 2015
1 min read

Example:

String selectStatement = “SELECT account_balance FROM user_data WHERE user_name = ? “;
PreparedStatement prepStmt = con.prepareStatement(selectStatement);
prepStmt.setString(1, request.getParameter(“customerName”));
ResultSet rs = prepStmt.executeQuery();