What is the best way of inserting data into database in java web application ??

Question

Approach 1 :

Connection connection=Connector.getConnection();
PreparedStatement ps1=connection.prepareStatement("insert into tbl_invtry(part_id,part_name)
                                                  values(?,?,)");
ps1.setString(1,action.getPart_id());
ps1.setString(2,action.getPart_name());

Approach 2 :

DAO dao = new DAOImpl(); //DB connection
String query="insert into tbl_entrp_proj(ASPECT_SRC_ID,PRNT_PROJ_ID)values('" + 
                                         project.getASPECT_SRC_ID() + "','" + 
                                         project.getPRNT_PROJ_ID() + "')";
boolean b = dao.insertQuery(query);

Please suggest which is the best, and why. Thanks in advance.

possible duplicate of [Java - escape string to prevent SQL injection](http://stackoverflow.com/questions/1812891/java-escape-string-to-prevent-sql-injection) — Sergey Kalinichenko, Jun 25 '13 at 18:48

score 2 · Answer 1 · answered Jun 25 '13 at 18:52

I would go for the 1st approach because:

It is more efficient - PreparedStatement can be compiled and reused by the database.
Security. When using a PreparedStatement, you don't need to worry about encoding and SQL injection.

However, I would consider a 3rd approach - using an ORM framework like Hibernate.

score 2 · Accepted Answer · edited May 23 '17 at 12:11

As Ashwin and dasblinkenlight stated, SQL injection is the concern.

In Approach 1 you've used parameterized queries to escape any user input to prevent SQL injection, in Approach 2 you've trusted the user to provide values that are directly inserted into your database.

Keep in mind that SQL injected statements may not be a problem on insert, but upon select (or other queries ) could wreck havoc with your data and database.

Not using Approach one is irresponsible at best, and disastrous at worst because of these reasons.

For a secondary reason of why approach 1 is best, take a look at this question which discusses the performance benefits of prepared statements, and heavily emphasizes the importance of protecting against SQL injection.

What is the best way of inserting data into database in java web application ??

2 Answers2