sql之statement

statement 与 prepareStatement的用法区别

Statement stmt=null; stmt.executeUpdate("insertintotb_name(col1,col2,col2,col4)values('"+var1+"','"+var2+"',"+var3+",'"+var4+"')"); perstmt=con.prepareStatement( "insertintotb_name(col1,col2,col2,col4)values(?,?,?,?)" ); perstmt.setString( 1 ,var1); perstmt.setString( 2 ,var2); perstmt.setString( 3 ,var3); perstmt.setString( 4 ,var4); perstmt.executeUpdate();