Loading published curriculum…

08 · SQL and JDBC / LESSON 33 OF 102

PreparedStatement, parameters, and injection prevention

Bind values so user input remains data rather than becoming SQL syntax.

Before this lesson: JDBC drivers, URLs, and connections

Understand the topic

PreparedStatement uses placeholders for values. Parameter indexes start at one. String concatenation can turn a title into part of the SQL grammar. Parameters cannot replace table names or ORDER BY identifiers; choose those from an allowlist.

executeUpdate returns affected rows for insert, update, and delete. Check the row count when your contract expects exactly one change. Closing a statement does not replace closing its connection; nest both resource scopes.

EXAMPLE · JAVA

JDBC update fragment

// Inside a method with an open Connection c; SQLException is propagated.
try (var ps = c.prepareStatement(
    "UPDATE work_items SET title = ? WHERE id = ? AND owner_id = ?")) {
 ps.setString(1, "Read JDBC");
 ps.setLong(2, 12L);
 ps.setLong(3, 7L);
 int changed = ps.executeUpdate();
 System.out.println(changed);
}

What to expect

Prints 1 only if task 12 belongs to owner 7; quotes inside a title remain a value.

YOUR TURN

Put it into practice

  1. 01Implement an owner-scoped title update.
  2. 02Try a title containing quotes and SQL-looking text using bound parameters.
  3. 03Verify: The title is stored literally and another owner cannot update the row.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

Bind values so user input remains data rather than becoming SQL syntax.

  1. 01PreparedStatement uses placeholders for values. Parameter indexes start at one. String concatenation can turn a title into part of the SQL grammar. Parameters cannot replace table names or ORDER BY identifiers; choose those from an allowlist.
  2. 02executeUpdate returns affected rows for insert, update, and delete. Check the row count when your contract expects exactly one change. Closing a statement does not replace closing its connection; nest both resource scopes.
  3. 03Trace the example: Prints 1 only if task 12 belongs to owner 7; quotes inside a title remain a value.

A mistake worth avoiding

A title containing an apostrophe breaks the SQL.

DEBUGGING ROOM

Something broke. Where do you look?

A title containing an apostrophe breaks the SQL.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Can a placeholder safely replace an arbitrary table name?

Choose one answer

BUILD IT YOURSELF

Implement an owner-scoped title update.

  1. 1.Implement an owner-scoped title update.
  2. 2.Try a title containing quotes and SQL-looking text using bound parameters.
  3. 3.Reproduce this failure, then repair it: A title containing an apostrophe breaks the SQL.

Acceptance checklist

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Can a placeholder safely replace an arbitrary table name?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

The title is stored literally and another owner cannot update the row.

Reading is separate from passing a knowledge check or completing a lab.

Go deeper · official references