Preventing SQL injection without prepared statements (JDBC)

Question

I have a database log appender that inserts a variable number of log lines into the database every once in a while.

I\'d like to create an SQL statement in a way tha

Answer 1

I can't think of a reason why you shouldn't use prepared statements. If you're running this on a J2EE server using connection pooling the server keeps your connections open, and the server caches your access/execution plans. It's not the data it caches!

If you're closing your connection every time, then you're probably not gaining any performance. But you still get the SQL injection prevention

Most java performance tuning books will tell you the same: Java performance tuning