Home/ Questions/Q 8710893
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-13T04:44:25+00:00

Java: PreparedStatement stmt = myConnection.prepareStatement(CALL myStoredRoutine(?, ?, ?)); stmt.setString(1, a); stmt.setString(2, b); stmt.setString(3, c);

  • 0

Java:

PreparedStatement stmt = myConnection.prepareStatement("CALL myStoredRoutine(?, ?, ?)");
stmt.setString(1, a);
stmt.setString(2, b);
stmt.setString(3, c);
stmt.executeQuery();

If my stored routine is in MySQL is it possible for the unfiltered Strings to inject something into my code?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    No, as PreparedStatement was build to protect against SQL Injection.

    I see you’re calling a stored procedure so better use CallableStatement.

    String SQL = "{CALL myStoredRoutine(?, ?, ?)}";
CallableStatement cstmt = myConnection.prepareCall(SQL);
    • Prepared Statement

    Instances of PreparedStatement contain an SQL statement that has already been compiled. This is what makes a statement “prepared”

    Because PreparedStatement objects are precompiled, their execution can be faster than that of Statement objects.

    The prepared statement is used to execute sql queries

    • Callable Statement

    A CallableStatement object provides a way to call stored procedures in a standard way for all RDBMSs. A stored procedure is stored in a database; the call to the stored procedure is what a CallableStatement object contains.

    • 0