prepareStatement与Statement的区别

1:创建时的区别： 
   Statement stm=con.createStatement(); 
   PreparedStatement pstm=con.prepareStatement(sql); 
执行的时候: 
    stm.execute(sql); 
    pstm.execute(); 
2: pstm一旦绑定了SQL,此pstm就不能执行其他的Sql，即只能执行一条SQL命令。 
stm可以执行多条SQL命令。 
3: 对于执行同构的sql（只有值不同，其他结构都相同）,用pstm的执行效率比较的高，对于异构的SQL语句，Statement的执行效率要高。 

4：当需要外部变量的时候，pstm的执行效率更高.

Why should use PrepareStatement ? 
1. The code is readable very well, especially when you set the parameters for where clause, it is easy to understand when use  stmt.setString(1, ‘a’)
2. The performance of PreparedStatement is better, because the PreparedStatement is precompiled and may be repeated calls. So as long as it is the same SQL, then next time you can call precompiled statements without compile, and pass the parameters to SQL directly.
3. It is very safe to use PreparedStatement, it can avoid the SQL injection