Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I noticed that when I use a PreparedStatement it doesn’t seem to escape certain wild-card characters like ‘%’ or ‘_’. I know these can be escaped in MySql using a backslash. This made me wonder, what characters will a PreparedStatement escape?
PreparedStatementdoesn’t escape anything – it relies on database support for precompiled statements.That is,
PreparedStatementnever substitutes?s for parameter values in order to form a literal query string. Instead, it sends a query string with placeholders to the database and uses database support to bind query parameters (however, it may depend on JDBC driver implementation).