Using prepared statement in the most secure way

Question

From a security validation perspective, is there a difference between:

stmt.setObject(1, theObject);

and

stmt.setString(1, theObject);?

I know that in this case theObject is a String but I am interested in making part of this code more general to cover other cases and was wondering if the security perspective of input validation is affected

Answer 1

It is ok to use ssetObject() because jdbc will try to to do the type resolution for all java.lang.* types.

However, there is potential problem with passing an arbitrary SQL string to the database in this way - Security loopholes: without very judicious validation of any parameters that you use to build up the SQL string, you are liable to various types of SQL insertion attacks.

Beware of passing untyped null to setObject()