Java EE 8 Development with Eclipse

Executing SQL statements

Use Statement for executing static SQL (having no parameters) and PreparedStatement for executing parameterized statements.

To avoid the risk of SQL injection, refer to https://www.owasp.org/index.php/SQL_injection.

To execute any Statement, you first need to create the statement using the Connection object. You can then perform any SQL operation, such as create, update, delete, and select. The Select statement (query) returns a ResultSet object. Iterate over the ResultSet object to get individual rows.

For example, the following code gets all rows from the Course table:

Statement stmt = null; ResultSet rs = null; try { stmt = con.createStatement(); rs = stmt.executeQuery("select * from Course"); List<Course> courses ...