JDBC with MySQL in Java

What is JDBC

JDBC (Java Database Connectivity) is the standard way for Java programs to talk to databases like MySQL. With it, you open a connection, send SQL queries, and read back the results — all from Java code. It is the foundation of database work in Java.

The JDBC steps

1. Add the MySQL JDBC driver to your project.
2. Get a Connection with the database URL, user and password.
3. Create a PreparedStatement for your SQL.
4. Execute it and get a ResultSet (for SELECT).
5. Loop the results and read each column.
6. Close the resources.

Connecting to MySQL

import java.sql.*;

String url = "jdbc:mysql://localhost:3306/school";
String user = "root";
String pass = "password";

Connection con = DriverManager.getConnection(url, user, pass);
System.out.println("Connected!");

DriverManager.getConnection opens the connection using the database URL, username and password. The URL points to the MySQL server and the database name.

Running a query

String sql = "SELECT name, marks FROM students WHERE marks > ?";
PreparedStatement ps = con.prepareStatement(sql);
ps.setInt(1, 40);              // fill the ? placeholder
ResultSet rs = ps.executeQuery();

A PreparedStatement uses ? placeholders for values, which you fill with setInt, setString, etc. executeQuery runs a SELECT and returns a ResultSet.

Reading results

while (rs.next()) {
    String name = rs.getString("name");
    int marks = rs.getInt("marks");
    System.out.println(name + ": " + marks);
}
rs.close(); ps.close(); con.close();

Loop with rs.next() to move through the rows, reading each column by name. Always close the ResultSet, statement and connection when done to free resources.

Prevent SQL injection

// SAFE: placeholder, input treated as data
PreparedStatement ps =
    con.prepareStatement("SELECT * FROM users WHERE email = ?");
ps.setString(1, userInput);

// UNSAFE: never build SQL by joining input
// "... WHERE email = '" + userInput + "'"

Always use a PreparedStatement with ? and setString. This treats input as data, never as SQL, which stops injection attacks — the same rule as in PHP and every language.

Common mistakes

• Building SQL with string joins. Use PreparedStatement placeholders to stay safe.
• Not closing resources. Close ResultSet, statement and connection (or use try-with-resources).
• Missing the driver. The MySQL JDBC driver must be on the classpath.
• Wrong column name in getString. It must match the SELECT column exactly.

Summary

• JDBC connects Java to databases like MySQL.
• Get a Connection with the URL, user and password.
• Use a PreparedStatement with ? placeholders for queries.
• Read a SELECT's rows from a ResultSet with rs.next().
• Always close resources and use placeholders to prevent SQL injection.

Next, design the database tables in MySQL data types, or secure queries with keys and constraints.