Which one of jdbc parameter passing is safer from SQL injection

[MaheshNarayanan]

Below I am using two different ways to pass parameters to SQL queries.

1st Method

String sql = "insert into db_table (associateid,comment) values(:associateId,:comments)";
    Map<String, Object> paramMap = new HashMap<String, Object>();
    paramMap.put("associateId", "12345");
    paramMap.put("comments", "some comments");
    int rowNumber = readTemplate.update(sql, paramMap);

2nd Method

 String sql = "insert into db_table (associateid,comment) values(:associateId,:comments)";
    int rowNumber = readTemplate.update(sql, new MapSqlParameterSource().addValue("associateId", "12345").addValue("comments", "some comments"));

Which one is safer from SQL injection ? If possible please give a reason why it is safe ?

Thanks in Advance

[Kara Hewett]

The initial code example is not vulnerable to SQL injection because it correctly uses parameterized queries. By using java's PreparedStatement class, bind variables and corresponding string methods, SQL injection can be easily prevented. The second example uses dynamic queries to concatenate potentially malicious data. The second example doesn't bind parameters and values therefore injection can occur within the string.