Which two descriptions are benefits of using PreparedStatement objects over static SQL in JDBC?
A.
Conversion to native SQL
B.
Supports BLOB types on every type of database
C.
Prevention of SQL injection attacks
D.
Improved performance from frequently run SQL queries
E.
Built in support for multi database transaction semantics
Explanation:
Sometimes it is more convenient to use a PreparedStatement object for sending
SQL statements to the database. This special type of statement is derived from the more general
class, Statement, that you already know.
If you want to execute a Statement object many times, it usually reduces execution time to use a
PreparedStatement object instead.
The main feature of a PreparedStatement object is that, unlike a Statement object, it is given a
SQL statement when it is created. The advantage to this is that in most cases, this SQL statement
is sent to the DBMS right away, where it is compiled. As a result, the PreparedStatement object
contains not just a SQL statement, but a SQL statement that has been precompiled. This means
that when the PreparedStatement is executed, the DBMS can just run the PreparedStatement
SQL statement without having to compile it first.
Although PreparedStatement objects can be used for SQL statements with no parameters, you
probably use them most often for SQL statements that take parameters. The advantage of using
SQL statements that take parameters is that you can use the same statement and supply it with
different values each time you execute it.
Reference: The Java Tutorials, Using Prepared Statements
C,D
PreparedStatement offers protection against SQL injection attacks.
Since parameters values of the query are set using setter methods, it is not possible to manipulate the resulting query by specifying ill formatted values.
Note: you are not required to learn how SQL injection works for the purpose of the exam. But it is good to know nevertheless.
The following link contains a good description: https://blogs.oracle.com/carolmcdonald/entry/owasp_top_10_number_2