Difference between PreparedStatement and StoredProcedure ?

From: lorenzo <lorenzo.el.sol_at_ifrance.com>
Date: 14 Mar 2007 09:14:45 -0700
Message-ID: <1173888885.566194.217710@l77g2000hsb.googlegroups.com>

Hi,

Well.. I'm trying to understand differences between the 3 ways of a web application to call a database (in a security and sql injection risks overview) :

Dynamic SQL Statement
PreparedStatement (with bind variable)
Stored procedures (or callable statement)

I have read some explanation on the web but i still have a lot of difficulties to understand the fondamental differences beetween preparedStatement and storedProcedure ?

The two ways seems to be effective to limit SqlInjection attacks but i don't see why StoredProcedure are better than PreparedStatement.

Is anybody have a good explanation for that ?

Thanks a lot in advance for your help

@+
Lorenzo Received on Wed Mar 14 2007 - 11:14:45 CDT