Take the 2-minute tour ×

I have some JDBC code as follows:


Integer userId = 1000;
char[] passwordString = new char[] { 't', 'e', 's', 't' };

PreparedStatement preparedStatement = dbConnection.prepareStatement(selectSQL);
preparedStatement.setInt(1, 1001);
preparedStatement.setArray(2,... ??? // how to do this part?

// execute select SQL statement
ResultSet rs = preparedStatement.executeQuery();

How do I call preparedStatement.setArray to set the second parameter in the query? I don't want to use a string parameter here to protect the password.

Note I am using Hypersonic DB but plan to move to MySql if this is useful.

share|improve this question
I'm not sure you want to do this. –  duffymo Dec 20 '12 at 13:31
Why? I wish to avoid using a String as I understand there is a certain security risk having the password in one. –  user1882491 Dec 20 '12 at 13:34
In this case no problem, there is a problem if you do not use a preparedstatement (sql injection) –  Aviram Segal Dec 20 '12 at 13:39
I think a salted and encrypted password would be a much better idea. –  duffymo Dec 20 '12 at 13:43

4 Answers 4

PreparedStatement#setArray received a java.sql.Array First you should use the JDBC Conncetion's createArrayOf method to create the array, only then you can pass it to setArray.

As the method only accept Object[] you should create an array of Character instead of char.

For example:

Character[] passwordString = new Character[] { 't', 'e', 's', 't' };
Array sqlArray = con.createArrayOf("CHAR", passwordString);
preparedStatement.setArray(2, sqlArray);
share|improve this answer
First you should know that the type in db is an ARRAY –  Damian Leszczyński - Vash Dec 20 '12 at 13:40
You need to provide the SQL name of the type the elements of the array map to (i.e. the type of the elements not the array itself) –  Aviram Segal Dec 20 '12 at 13:42
You did not undestand. Then type of column in dabase should be Array. Then you can use java.sql.Array. This type allow you to store multiple data in single row, without any additional relation. It was not designed in the way you are trying to imply. –  Damian Leszczyński - Vash Dec 20 '12 at 14:00
Ah yes, the column type is ARRAY, what did I imply ? –  Aviram Segal Dec 20 '12 at 14:03
It is not common to use this type for storing data as you have preseted as solution. –  Damian Leszczyński - Vash Dec 20 '12 at 14:06

If you want to pass an array in prepared statement just call


But what you must assure first is that in your DB the column is also a ARRAY. For more detail please see Aviram Sagal answer.

But your base idead it to protect the password.

This solution will protect only from reading the passoword from Java string pool. This is very ratre type of attact anyway. Ans passoword is transmited as plain text.

My sugestion is that instead of complicating the db schema, you should use some benefits of cryptography. Instaed of passing the password value, you should pass password digest.

A simplyfied example of digest function.

public static String getDigest(byte[] password) {

  return new String(Hex.encodeHex(new MessageDigest.getInstance("SHA").digest(password)));


Then you store in db the digest with is safe and you use simple string in queries.

share|improve this answer

Have a look at this code

final PreparedStatement statement = connection.prepareStatement(
        "SELECT my_column FROM my_table " + 
        "where search_column IN (SELECT * FROM unnest(?))"
final String[] values = getValues();
statement.setArray(1, connection.createArrayOf("text", values));
final ResultSet rs = statement.executeQuery();
try {
    while(rs.next()) {
        // do some...
} finally {

also please take a look at this article for reference http://people.apache.org/~djd/derby/publishedapi/java/sql/PreparedStatement.html

share|improve this answer
That uses a string and I wish to avoid using a string. Is it possible with an array of char? –  user1882491 Dec 20 '12 at 13:32

Another alternative is to use a CharArrayReader and call the statement.setCharacterStream.

statement.setCharacterStream(1, new CharArrayReader(passwordString));
share|improve this answer

Your Answer


