PreparedStatement真的比Statement快吗？

PreparedStatement

PreparedStatements are implemented by the driver, as MySQL does not have a prepared statement feature. Because of this, the driver does not implement getParameterMetaData() or getMetaData() as it would require the driver to have a complete SQL parser in the client.

Starting with version 3.1.0 MySQL Connector/J, server-side prepared statements and binary-encoded result sets are used when the server supports them.

是的，你们确实做了无用功。测试的目的在于指导实践。就单个请求来说statement要快，但是如果按照这种思路去写代码，后果是很严重的。因为会对数据库服务器造成很重的压力，系统吞吐量也要降低。早在2001年的时候，我维护的一个系统(访问量巨大，每天上百万)，Oracle数据库每周都要宕机一次，经过几个月的排查，最终找到的原因就是我们程序所有的条件查询全部都是statement拼SQL字符串。全部改掉以后恢复正常，性能也明显提高。

实际的应用程序都是多用户并发的web应用，不是单机自己一个人用的，你们那种测试根本就不能反应实际的多用户并发的系统吞吐量和数据库负载情况，不是误导是什么？

In Embedded SQL, dynamic statements are SQL statements that need to be compiled at runtime, rather than statically. Typically, dynamic statements contain input parameters, although this is not a requirement. In SQL, the prepare command is used to precompile a dynamic statement and save it so that it can be executed repeatedly without being recompiled during a session. If a statement is used multiple times in a session, precompiling it provides better performance than sending it to the database and compiling it for each use. The more complex the statement, the greater the performance benefit.If a statement is likely to be used only a few times, precompiling it may be inefficient because of the overhead involved in precompiling, saving, and later deallocating it in the database.Precompiling a dynamic SQL statement for execution and saving it in memory uses time and resources. If a statement is not likely to be used multiple times during a session, the costs of doing a database prepare may outweigh its benefits. Another consideration is that once a dynamic SQL statement is prepared in the database, it is very similar to a stored procedure. In some cases, it may be preferable to create stored procedures and have them reside on the server, rather than defining prepared statements in the application.

PreparedStatement 更重要的功能是防sql 注入.

哪里有说不支持了？


http://dev.mysql.com/doc/refman/5.0/en/sqlps.html

13.7. SQL Syntax for Prepared Statements

MySQL 5.0 provides support for server-side prepared statements. This support takes advantage of the efficient client/server binary protocol implemented in MySQL 4.1, provided that you use an appropriate client programming interface. Candidate interfaces include the MySQL C API client library (for C programs), MySQL Connector/J (for Java programs), and MySQL Connector/NET.