In contrast to PreparedStatement the Statement doesn’t offer support for the parameterized SQL queries, which is an important protection from SQL injection attacks. With that said, Statement would be suitable for the execution of the DDL (Data Definition Language) statements, such as CREATE, ALTER, DROP.