# JDBC — Advanced Java

Source: https://www.geekswithgeeks.com/en/advanced-java/adv-jdbc

> Talk to a relational database from Java with JDBC — always use PreparedStatement against SQL injection, manage transactions, and close resources properly.

## PreparedStatement always

Never concatenate values into SQL — use `?` placeholders and a `PreparedStatement` to prevent SQL injection and let the driver cache the plan. Close `Connection`, `Statement`, `ResultSet` via try-with-resources.

```java
String sql = "SELECT name FROM users WHERE age > ?";
try (var conn = DriverManager.getConnection(url, user, pass);
     var ps = conn.prepareStatement(sql)) {
    ps.setInt(1, 18);
    try (var rs = ps.executeQuery()) {
        while (rs.next()) System.out.println(rs.getString("name"));
    }
}
```

## Transactions

Turn off autocommit to group statements. Commit on success, roll back on any exception. In real apps a connection pool (HikariCP) and a framework (JPA, jOOQ, Spring JDBC) manage this.

```java
conn.setAutoCommit(false);
try {
    debit.executeUpdate();
    credit.executeUpdate();
    conn.commit();
} catch (SQLException e) {
    conn.rollback();
    throw e;
}
```