java - Preventing SQL injection without prepared statements (JDBC)

Question

I have a database log appender that inserts a variable number of log lines into the database every once in a while.

I'd like to create an SQL statement in a way that prevents SQL injection, but not using server-side prepared statements (because I have a variable number of rows in every select, caching them won't help but might hurt performance here).

I also like the convenience of prepared statments, and prefer them to string concatination. Is there something like a 'client side prepared statement' ?

Answer 1

It sounds like you haven't benchmarked the simplest solution - prepared statements. You say that they "might hurt performance" but until you've tested it, you really won't know.

I would definitely test prepared statements first. Even if they do hamper performance slightly, until you've tested them you won't know whether you can still achieve the performance you require.

Why spend time trying to find alternative solutions when you haven't tried the most obvious one?

If you find that prepared statement execution plan caching is costly, you may well find there are DB-specific ways of tuning or disabling it.