sql之statement

statement 与 prepareStatement的用法区别

Statement stmt=null;
 stmt.executeUpdate("insertintotb_name(col1,col2,col2,col4)values('"+var1+"','"+var2+"',"+var3+",'"+var4+"')");

 perstmt=con.prepareStatement("insertintotb_name(col1,col2,col2,col4)values(?,?,?,?)");
 perstmt.setString(1,var1);
 perstmt.setString(2,var2);
 perstmt.setString(3,var3);
 perstmt.setString(4,var4);
 perstmt.executeUpdate();