title: JDBC PrepareStatement parameters do not work for CREATE, DROP, ALTER
body: <p>I need to use JDBC to create a new Oracle user. The user name and password of the new user are provided by the user via a GUI. The following codes works fine (I can also use Statement instead of PreparedStatement).</p>
  
  <pre><code>PreparedStatement preparedStatement = connection.prepareStatement("create user " + username + " identified by " + password);
  preparedStatement.execute();
  </code></pre>
  
  <p>However, since the user name and password are provided by the user, they may contain special characters like space, semi-column, quotes, etc, which may make the above statement invalid. I don't want my codes to be doing the validations of the user name and password, and to leave it to Oracle for the validation. Therefore, I thought of using parameters in the prepared statement instead:</p>
  
  <pre><code>PreparedStatement preparedStatement = connection.prepareStatement("create user ? identified by ?");
  preparedStatement.setString(1, userName);
  preparedStatement.setString(2, password);
  preparedStatement.execute();
  </code></pre>
  
  <p>But it doesn't work at all. When I supply a valid user name and password, I will get "ORA-01935: missing user or role name". It seems that the parameters do not work for CREATE, DROP, ALTER statements. How to resolve my problem? Thanks in advance.</p>