- Roman Rokytskyy writes:

> It is conceptually wrong to use prepared statement only to
> convert question marks into string representation of the parameters

Thanks for responding! It's not only for that, I have to manipulate
the String, as mentioned.

- David Jencks writes:

> I recommend you use only prepared statements, even for static sql.

Thank you for the recommendation! If I got you right (?), you mean
that a prepared statement provides the advantage of precompiling the
SQL code to see if it is executable, according to the security
requirements of the particular database system.