title: JDBI - What's the difference between @define and @bind in JDBI?
body: <p>Are both functions sanitized / safe against SQL injection? For example, consider the following:</p>
  
  <pre><code>@SqlUpdate("INSERT INTO &lt;tableName&gt; (&lt;columns&gt;) VALUES (&lt;values&gt;)")
      public abstract void addRowToDataset(@Define("tableName") String tableName, @Define("columns") String columns, @BindIn("values") Collection&lt;Object&gt; values);
  </code></pre>
  
  <p>My current understanding is that <code>@define</code> literally inserts the string as is into the query, but <code>@bind</code> does sanitization. So if we control the <code>columns</code> and tableName <code>parameters</code> and only the <code>values</code> parameter is user input, then we should be fine. </p>