Spring NamedParameterJDBCTemplate reuse of Prepared Statements

泄露秘密 提交于 2019-12-05 05:38:36

Looking at the source code of Spring's NamedParameterJdbcTemplate, it parses your SQL into a structure ParsedSql, and then replaces your named parameters with question marks, then builds the PreparedStatement and fills it with your parameters.

It caches the ParsedSql entries, but always builds new PreparedStatements so ultimately these are not reused at the JDBC driver level.

A PreparedStatement has two advantages over a regular Statement:

  1. You add parameters to the SQL using methods instead of doing it inside the SQL query itself. With this you avoid SQL injection attacks and also let the driver to do type conversions for you.

  2. As you said, the same PreparedStatement can be called with different parameters, and the database engine can reuse the query execution plan.

It seems that NamedParameterJdbcTemplate helps you with the first advantage, but does nothing for the latter.

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!