There is 2 different prepared statement in Mariadb jdbc driver :
- client implementation
- server implementation
Server implementation on Connection.prepareStatement(<query>) will send a PREPARE command to server,
prepareStatement.execute() will send parameters to server and execute command.
Client implementation is different : driver will parse query and replace "?" parameters with escaped parameters.
Example :
query "Insert into table1 value 
".
parameter is "Bob's".
There is 2 different escapes according to server NO_BACKSLASH_ESCAPES (https://mariadb.com/kb/en/library/sql-mode/ ).
if NO_BACKSLASH_ESCAPES is set, quote will be escaped by quote. if not set, escape character is BACKSLASH.
So depending on SQL_MODE values :
if NO_BACKSLASH_ESCAPES is set: "Insert into table1 value ('Bob''s')"
if NO_BACKSLASH_ESCAPES is NOT set : "Insert into table1 value ('Bob\'s')"
By default NO_BACKSLASH_ESCAPES is not set, so escape will use BACKSLASH, then beeing compatible with other DBMS.
this SQL_MODE can be set on connectionString. Example :
"jdbc:mariadb://host/db?user=xxx&sessionVariables=sql_mode=NO_BACKSLASH_ESCAPES"