JDBC中Statement和Preparement的使用讲解

//已定义好driver、url、user、passwd等
//加载驱动
Class.forName(driver);
//获得连接
Connection conn = DriverManager.getConnection(url, user, passwd);

//用Connection创建一个Statement
Statement stmt = conn.createStatement() {
  //100条SQL语句来插入100条记录
  for(int i = 0;i < 100;i++) {
    stmt.executeUpdate("insert into student values(" + "null, 'aaa" + i + "',90)");
  }
}

//用Connection创建一个PreparedStatement
PreparedStatement pstmt = conn,getPreparedStatement("insert into student_table values(null, ?, 90)") {
  //设置参数，100次传入参数而不是100次传入SQL语句
  for(int i = 0;i < 100;i++) {
    pstmt.setString(1, "姓名" + i);
  //执行
  pstmt.executeUpdate();
  }
}

//传入参数username和passwd是提交的信息
String sql = "select * from users " + "where username = ' " + username + " ' and password= ' " + passwd + " ';
rs = stmt.executeQuery(sql);

select * from users where username = ' ' or true or ' ' and desc = ' ';

//传入参数username和passwd是提交的信息
PreparedStatement pstmt = conn.getPreparedStatement("select * from users where username = ? and password= ?");
pstmt.setString(1, username);
pstmt.setString(2, passwd);