Which two descriptions are benefits of using PreparedStatement objects over static SQL in JDBC?
A.
Conversion to native SQL
B.
Supports BLOB types on every type of database
C.
Prevention of SQL injection attacks
D.
Improved performance from frequently run SQL queries
E.
Built in support for multi database transaction semantics
Explanation:
Sometimes it is more convenient to use a PreparedStatement object for sending SQL statements to the database. This special type of statement is derived from the more general class, Statement, that you already know.
If you want to execute a Statement object many times, it usually reduces execution time to use a PreparedStatement object instead.
The main feature of a PreparedStatement object is that, unlike a Statement object, it is given a SQL statement when it is created. The advantage to this is that in most cases, this SQL statement is sent to the DBMS right away, where it is compiled. As a result, the PreparedStatement object contains not just a SQL statement, but a SQL statement that has been precompiled. This means that when the PreparedStatement is executed, the DBMS can just run the PreparedStatement SQL statement without having to compile it first.
Although PreparedStatement objects can be used for SQL statements with no parameters, you probably use them most often for SQL statements that take parameters. The advantage of using SQL statements that take parameters is that you can use the same statement and supply it with different values each time you execute it.
Reference: The Java Tutorials, Using Prepared Statements
C,D
+1
PreparedStatement offers protection against SQL injection attacks.
Since parameters values of the query are set using setter methods, it is not possible to manipulate the resulting query by specifying ill formatted values.
Note: you are not required to learn how SQL injection works for the purpose of the exam. But it is good to know nevertheless.
The following link contains a good description: https://blogs.oracle.com/carolmcdonald/entry/owasp_top_10_number_2