preparedStatement与createStatemt优缺点对比

[小傅哥]

希望各位[color=#0000FF]猿友不吝赐教[/color]

个人觉得

方式1：加到缓存区（速度快，不易于随时更改sql，但易于执行同样的sql）

ps = conn.preparedStatement(sql);
ps.setString(...);
ps.execteQuery();

方式2：创建（速度慢，易于随时更改sql）

ps = conn.createStatemt();
ps.execteQuery(sql);

[scbb]

preparedStatement最大的好处不是防止SQL注入吗？ 然后是多次执行速度快吧。

[小傅哥]

有人说preparedStatement有空指针异常
我因此写个例子解决

/**
	 * 模糊查询,分析出姓名，性别，年龄
	 */
	public ArrayList<_students> doSearch(String name,String sex,String age) throws SQLException{
		
		int idNum = 1;
		
		conn = ConnMysql.getConn();
		
		String searchSql = "select * from students where name = ? && sex = ? && age = ? order by id limit 0,10";
		/*根据传过来数据是否为空，重组sql*/
		if(name.equals("")){
			searchSql = searchSql.replace("name = ?", "");
		}
		if(sex.equals("")){
			searchSql = searchSql.replace("&& sex = ?", "");
		}
		if(age.equals("")){
			searchSql = searchSql.replace("&& age = ?", "");
		}
		
		searchSql = searchSql.replaceAll("[^//?] &&", "");
		
	    if(!searchSql.contains("=")){
	    	searchSql = searchSql.replace("where", "");
	    }
	    /*重组好的sql放进去*/
	    ps = conn.prepareStatement(searchSql);
	    //根据剩下几个?号，重新给定值
	    if(!name.equals("")){
			ps.setString(idNum, name);
			idNum ++;
	    }
	    if(!sex.equals("")){
	    	ps.setString(idNum, sex);
			idNum ++;
	    }
	    if(!age.equals("")){
	    	ps.setString(idNum, age);
			idNum ++;
	    }
	    
	    rs = ps.executeQuery();
	    alStudents = new ArrayList<_students>();
	    
	    while(rs.next()){
	    	_students st = new _students();
	    	ss.setPageCount(pageCount);
	    	st.setType("首次");
	    	st.setPageNow(0);
	    	st.setId(rs.getString(1));
	    	st.setName(rs.getString(2));
	    	st.setSex(rs.getString(3));
	    	st.setAge(rs.getString(4));
	    	st.setHobby(rs.getString(5));
	    	alStudents.add(st);
	    }
	    
	    return alStudents;
	}