Rule Definition
There are two benefits to use PreparedStatement or CallableStatement over Statement: - Performance: PreparedStatement gives better performance when compared to Statement because it is pre-parsed. CallableStatement is even more efficient but as it uses a stored procedure in the database, it is less portable, - Security: to prevent SQL Injection Attacks.

Remediation
use java.sql.Connection.prepareStatement() or java.sql.Connection.prepareCall() instead.

Violation Code Sample

Statement stmt = connection.createStatement(); // VIOLATION

ResultSet rs = stmt.executeQuery("select address from employee where name=Bob");

Fixed Code Sample

PreparedStatement ps = connection.prepareStatement("select address from employee where name=Bob"); // FIXED

ResultSet rs = ps.executeQuery();

http://www.theserverside.com/tt/articles/article.tss?l=JavaOne2006Day4 http://www.precisejava.com/javaperf/j2ee/JDBC.htm