PreparedStatement itself provides this protection but only if used correctly (use placeholders / never string concatenation). http://stackoverflow.com/questions/1582161/how-does-a-preparedstatement-avoid-or-prevent-sql-injection