Week 3 Cont

Question 1

Statement is okay to use for SQL commands that are fixed, but when user input is required it is best to use _______________.

Answer 1

PreparedStatement.

Question 2

What does PreparedStatement allow us to do that Statement does not? Why is this better than Statement?

Answer 2

use “?” as a placeholder in the SQL statements.

There will never be a conflict between the SQL vars and the program vars.

Question 3

T/F - PreparedStatement prevents SQL injection (hacking technique)

Answer 3

True.

Question 4

PreparedStatement prepQuery=connection.prepareStatement(
“select * from user where name = ?”);
prepQuery.setString(1, name);

How does setString() work in conjunction with with preparedStatement?

Answer 4

preparedStatement is interpreted as SQL

setString does a replacement with that is not interpreted as SQL. Anything that an end user inputs is not interpreted as SQL by setString

Question 5

How does RowSet extend ResultSet?

Answer 5

Resultset must be connected to a DB for the duration

Rowset does not have to always be connected