Why Prepared Statement is faster than Statement in Java JDBC.

Why Prepared Statement is faster than Statement in Java.

---

Prepared Statement is faster than Statement in Java. Prepared Statement is better because it caches query so is fast and prevents from SQL Injection.

This is the famous interview question for the beginners, So Let's see what it is all about.

SQL Injection is code injection technique where SQL is injected by user (as part of user input) into the back end query, and ultimately changes query purpose which upon execution gives harmful result.

Detailed explanation on SQL Injection: What is SQL Injection?

How can SQL Injection happen.

---

At server side, queries generally by themselves are not complete and require user data to make it complete, meaningful and executable.

"select * from user where username = ' " + username + " ' ";

Above query is not complete as it has dependency on username variable.
Now if username variable is filled by third party, then there are chances that user data contains SQL,

Take an example. Application is asking user to enter user name,
Enter user name:________________________

Enter user name:___jayesh'; delete from user where id='1__

At Server Side,

username = "jayesh'; delete from user where id='1"
Final Query = "select * from user where username = ' jayesh'; delete from user where id='1 ' ";

If you observe final query, upon execution it will delete the record from user table which was never the purpose of original query and this is called SQL Injection attack. 

Because of user data (which can be anything and uncontrolled) involvement in formation of query, SQL Injection attack can happen.

Detailed explanation on: How can SQL Injection happen?

How PreparedStatement in Java prevents SQL Injection?

---

To understand this, Lets see steps involved in query execution.
1. Compilation Phase.
2. Execution Phase.

Whenever SQL server engine receives a query, It has to pass through below phases,

Read more

Advantages of Prepared Statement in Java JDBC.

Advantages of Prepared Statement in Java.

---

Advantages of Prepared Statement in Java JDBC. benefit of using Prepared Statement is it prevents from SQL Injection. PreparedStatement is fast and gives better performance.

This is the famous interview question for the beginners, So Let's see what it is all about.

SQL Injection is code injection technique where SQL is injected by user (as part of user input) into the back end query, and ultimately changes query purpose which upon execution gives harmful result.

Detailed explanation on SQL Injection: What is SQL Injection?

How can SQL Injection happen.

---

At server side, queries generally by themselves are not complete and require user data to make it complete, meaningful and executable.

"select * from user where username = ' " + username + " ' ";

Above query is not complete as it has dependency on username variable.
Now if username variable is filled by third party, then there are chances that user data contains SQL,

Take an example. Application is asking user to enter user name,
Enter user name:________________________

Enter user name:___jayesh'; delete from user where id='1__

At Server Side,

username = "jayesh'; delete from user where id='1"
Final Query = "select * from user where username = ' jayesh'; delete from user where id='1 ' ";

If you observe final query, upon execution it will delete the record from user table which was never the purpose of original query and this is called SQL Injection attack. 

Because of user data (which can be anything and uncontrolled) involvement in formation of query, SQL Injection attack can happen.

Detailed explanation on: How can SQL Injection happen?

How PreparedStatement in Java prevents SQL Injection?

---

To understand this, Lets see steps involved in query execution.
1. Compilation Phase.
2. Execution Phase.

Whenever SQL server engine receives a query, It has to pass through below phases,

Read more

How Prepared Statement works internally in Java.

How Prepared Statement works internally in Java.

---

How Prepared Statement works internally in Java. Prepared Statement is part of Java JDBC API. PreparedStatement internally caches query.

This is the famous interview question for the beginners, So Let's see what it is all about.

SQL Injection is code injection technique where SQL is injected by user (as part of user input) into the back end query, and ultimately changes query purpose which upon execution gives harmful result.

Detailed explanation on SQL Injection: What is SQL Injection?

How can SQL Injection happen.

---

At server side, queries generally by themselves are not complete and require user data to make it complete, meaningful and executable.

"select * from user where username = ' " + username + " ' ";

Above query is not complete as it has dependency on username variable.

Now if username variable is filled by third party, then there are chances that user data contains SQL,

Take an example. Application is asking user to enter user name,
Enter user name:________________________

Enter user name:___jayesh'; delete from user where id='1__

At Server Side,

username = "jayesh'; delete from user where id='1"
Final Query = "select * from user where username = ' jayesh'; delete from user where id='1 ' ";

If you observe final query, upon execution it will delete the record from user table which was never the purpose of original query and this is called SQL Injection attack. 

Because of user data (which can be anything and uncontrolled) involvement in formation of query, SQL Injection attack can happen.

Detailed explanation on: How can SQL Injection happen?

How PreparedStatement in Java prevents SQL Injection?

---

To understand this, Lets see steps involved in query execution.
1. Compilation Phase.
2. Execution Phase.

Whenever SQL server engine receives a query, It has to pass through below phases,

Read more

SQL Injection attack example in Java.

Explain SQL Injection along with example?

---

SQL Injection attack with Example in Java. Let's see what is SQL Injection. How SQL Injection attack works. How to prevent SQL Injection. SQL Injection is code injection technique.

SQL Injection is code injection technique where SQL is injected by user (as part of user input) into the back end query. Injected SQL data alters the purpose of original query and upon execution can gives harmful result.  

A SQL injection attack is very dangerous and attacker can,
1. Read sensitive data from the database.
2. Update database data (Insert/Update/Delete).
3. Slowdown the complete Database system etc.

Read more

How PreparedStatement in Java prevents SQL Injection?

What is PreparedStatement in java?
Why use PreparedStatement in Java JDBC?
How prepared statement prevents SQL Injection?
Difference between Statement and PreparedStatement in Java?

---

This is the famous interview question for the beginners, So Let's see what it is all about.

SQL Injection is code injection technique where SQL is injected by user (as part of user input) into the back end query, and ultimately changes query purpose which upon execution gives harmful result.

Detailed explanation on SQL Injection: What is SQL Injection?

How can SQL Injection happen.

---

At server side, queries generally by themselves are not complete and require user data to make it complete, meaningful and executable.

"select * from user where username = ' " + username + " ' ";

Above query is not complete as it has dependency on username variable.

Now if username variable is filled by third party, then there are chances that user data contains SQL,

Take an example. Application is asking user to enter user name,
Enter user name:________________________

Enter user name:___jayesh'; delete from user where id='1__

At Server Side,

username = "jayesh'; delete from user where id='1"
Final Query = "select * from user where username = ' jayesh'; delete from user where id='1 ' ";

If you observe final query, upon execution it will delete the record from user table which was never the purpose of original query and this is called SQL Injection attack. 

Because of user data (which can be anything and uncontrolled) involvement in formation of query, SQL Injection attack can happen.

Detailed explanation on: How can SQL Injection happen?

How PreparedStatement in Java prevents SQL Injection?

---

To understand this, Lets see steps involved in query execution.
1. Compilation Phase.
2. Execution Phase.

Whenever SQL server engine receives a query, It has to pass through below phases,

Read more

What is SQL Injection?

Explain SQL Injection along with example?

---

This is the famous interview question for the beginners, So Let's see what it is all about.

SQL Injection is code injection technique where SQL is injected by user (as part of user input) into the back end query. Injected SQL data alters the purpose of original query and upon execution can gives harmful result.

A SQL injection attack is very dangerous and attacker can,

1. Read sensitive data from the database.
2. Update database data (Insert/Update/Delete).
3. Slowdown the complete Database system etc.

Read more

How to enable or allow remote access to PostgreSQL database server.

For enabling remote access to PostgreSQL database server,

There are 2 main PostgreSQL configuration files that need to be changed to allow remote connections.
1. postgresql.conf
2. pg_hba.conf

postgresql.conf

---

It will be located in PostgreSQL installed directory,

In Linux, You may find file at location below,

1. /var/lib/pgsql/data/
2. /etc/postgresql/9.1/main/

In Windows, You may find file at location below,

1. C:/ProgramData/PostgreSQL/9.3/postgresql.conf

For exact location of "postgresql.conf" file, run the below command in psql command prompt.

SHOW config_file;

Open the file and search for "listen_addresses" and set listen_addresses parameter to,

listen_addresses = '*'

pg_hba.conf

---

It will be located in several directory, depending on how postgresql is installed

In Linux, You may find file at location below,

1. /home,
2. /var/lib/pgsql, 
3. /var/lib/postgresql/[version]/, 
4. /opt/postgres/  
5. /etc/postgresql/[version]/main/

In Windows, You may find file at location below,

1. C:/ProgramData/PostgreSQL/9.3/pg_hba.conf

For exact location of "pg_hba.conf" file, run the below command in psql command prompt.

SHOW hba_file; 

If you want PostgreSQL to accept incoming connection from any IP address then add entry like below,

 host             all             all             0.0.0.0/0             md5 

If you want PostgreSQL to accept incoming connection from particular IP address, say 192.168.82.2 then add entry in pg_hba.conf file like below,

host             all             all            192.168.82.2/24       md5 

Reload Configuration

---

After the changes are done, you have to reload the configuration as a superuser. run below command,

SELECT pg_reload_conf(); 

Done.

If PostgreSQL is still not accepting remote connection then try restarting the PostgreSQL service like below.

In Linux, If your PostgreSQL service name is "postgresql" then execute below command

service postgresql restart

In Windows, You can find service at

Start Menu ---> Search "Run" ---> Type "Services.msc" ---> Search "PosgreSQL"  
 ---> Right click and select Restart Service.

---

Explain SQL Injection with example?

When to use Builder design pattern

How Recursion works internally with example

Difference between process and thread

Burning Rope Puzzle - Measure 45 Minutes

Union and Intersection of Two Sorted Arrays

Merge two sorted arrays in Java

Enjoy !!!! 

If you find any issue in post or face any error while implementing, Please comment.

Read more