Lesson 15 / 38

JDBC

Talk to a relational database from Java with JDBC — always use PreparedStatement against SQL injection, manage transactions, and close resources properly.

PreparedStatement always

Never concatenate values into SQL — use ? placeholders and a PreparedStatement to prevent SQL injection and let the driver cache the plan. Close Connection, Statement, ResultSet via try-with-resources.

String sql = "SELECT name FROM users WHERE age > ?";
try (var conn = DriverManager.getConnection(url, user, pass);
     var ps = conn.prepareStatement(sql)) {
    ps.setInt(1, 18);
    try (var rs = ps.executeQuery()) {
        while (rs.next()) System.out.println(rs.getString("name"));
    }
}

Transactions

Turn off autocommit to group statements. Commit on success, roll back on any exception. In real apps a connection pool (HikariCP) and a framework (JPA, jOOQ, Spring JDBC) manage this.

conn.setAutoCommit(false);
try {
    debit.executeUpdate();
    credit.executeUpdate();
    conn.commit();
} catch (SQLException e) {
    conn.rollback();
    throw e;
}