Preventing SQL injection without prepared statements (JDBC)

Question

I have a database log appender that inserts a variable number of log lines into the database every once in a while.

I'd like to create an SQL statement in a way that prevents SQL injection, but not using server-side prepared statements (because I have a variable number of rows in every select, caching them won't help but might hurt performance here).

I also like the convenience of prepared statments, and prefer them to string concatination. Is there something like a 'client side prepared statement' ?

Answer 1

It sounds like you haven't benchmarked the simplest solution - prepared statements. You say that they "might hurt performance" but until you've tested it, you really won't know.

I would definitely test prepared statements first. Even if they do hamper performance slightly, until you've tested them you won't know whether you can still achieve the performance you require.

Why spend time trying to find alternative solutions when you haven't tried the most obvious one?

If you find that prepared statement execution plan caching is costly, you may well find there are DB-specific ways of tuning or disabling it.

Answer 2

Not sure if I understand your question correctly. Is there something in PreparedStatement that isn't fitting your needs?

I think that whether or not the statement is cached on the server side is an implementation detail of the database driver and the specific database you're using; if your query/statement changes over time than this should have no impact - the cached/compiled statements simply won't be used.