JDBC Statement Types — Statement, PreparedStatement, CallableStatement

Direct Answer

Statement executes SQL text without bind markers. PreparedStatement represents parameterized SQL and is the normal choice for data values. CallableStatement invokes stored procedures/functions according to driver support and extends PreparedStatement. PreparedStatement may use server preparation or plan reuse, but 'precompiled' is not a universal execution guarantee; its reliable safety comes from bound-value semantics.

Code Example

// Statement — static SQL only (no input)
try (Statement st = con.createStatement();
     ResultSet rs = st.executeQuery("SELECT COUNT(*) FROM users")) { /* ... */ }

// PreparedStatement — parameterized, safe (the default)
try (PreparedStatement ps = con.prepareStatement("SELECT * FROM users WHERE id = ?")) {
    ps.setInt(1, 42);
    try (ResultSet rs = ps.executeQuery()) { /* ... */ }
}

// CallableStatement — stored procedure
try (CallableStatement cs = con.prepareCall("{call get_user(?)}")) {
    cs.setInt(1, 42);
    cs.execute();
}

Common Mistakes & Pitfalls

• Using Statement with concatenated input: opens SQL injection — use PreparedStatement.
• Thinking they're unrelated: they form an inheritance chain.
• Reaching for Statement by habit: prefer PreparedStatement for nearly everything.
• Using CallableStatement for plain queries: it's for stored procedures.