What is the difference between using a simple Statement and a prepared PreparedStatement for executing SQL queries in JDBC?

Main differences between Statement and PreparedStatement in JDBC:

• Statement is used for executing simple SQL queries without parameters. The query is formed as a string and sent for execution.
• PreparedStatement allows creating parameterized queries with placeholders (e.g., ?), which can be safely filled with values.

Advantages of PreparedStatement:

• Security: prevents SQL injection through proper escaping of parameters.
• Performance: the query is compiled once and can be executed multiple times with different parameters.
• Convenience: simplifies working with dynamic data.

Example of using PreparedStatement:

String sql = "SELECT * FROM users WHERE id = ?";
PreparedStatement ps = connection.prepareStatement(sql);
ps.setInt(1, 10);
ResultSet rs = ps.executeQuery();

While Statement requires string concatenation, which is unsafe and less efficient.