JDBC Driver for Veeva Vault

Build 20.0.7587

Using Prepared Statements

The PreparedStatement object represents a precompiled SQL statement. A PreparedStatement can be used multiple times and mitigates SQL injection attacks. A PreparedStatement can be a SELECT, INSERT, UPDATE, or DELETE statement.

To execute a prepared statement, you can use the generic execute method of the Statement class. This section describes how to execute a prepared statement.

  1. Instantiate a PreparedStatement object with the prepareStatement method of the Connection class.

    See Connecting from Code to create the connection.

  2. Declare parameters by calling the PreparedStatement's corresponding setter method. Note that the parameter indices start from one.
  3. Call the PreparedStatement's execute method to execute the statement.
  4. Call the PreparedStatement's getResultSet method to pull the results into a ResultSet object.
  5. Call ResultSet.next to iterate over the result set. Use the ResultSetMetaData class to obtain column information about the result set. To instantiate a ResultSetMetaData object, call the ResultSet's getMetaData method.


The following example shows how to execute a SELECT prepared statement:

String query = "SELECT * FROM Documents WHERE Id=? AND Name=?";
PreparedStatement pstmt = conn.prepareStatement(query);
pstmt.setString(1, "XXX");
pstmt.setString(2, "YYY");
boolean ret = pstmt.execute();
if (ret) {
  ResultSet rs=pstmt.getResultSet();
  while(rs.next()) {
    for(int i=1;i<=rs.getMetaData().getColumnCount();i++) {
      System.out.println(rs.getMetaData().getColumnName(i) +"="+rs.getString(i));

Copyright (c) 2020 CData Software, Inc. - All rights reserved.
Build 20.0.7587