Skip to content

Commit 1664121

Browse files
denreadenrea
authored
Merge pull request #36371 from VanMSFT/sql-security-freshness-review-20260122-1541
Fix 5 high-priority UUF items: PKI cryptography, symmetric key example, SPN permissions, ODBC batches, JDBC API
2 parents 8ada0f3 + c880193 commit 1664121

9 files changed

Lines changed: 179 additions & 111 deletions

‎docs/connect/jdbc/reference/preparestatement-method-java-lang-string-int-array.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
title: "prepareStatement Method (java.lang.String, int[])"
3+
description: "prepareStatement Method (java.lang.String, int[])"
4+
author: David-Engel
5+
ms.author: davidengel
6+
ms.date: "01/22/2026"
7+
ms.service: sql
8+
ms.subservice: connectivity
9+
ms.topic: reference
10+
apilocation: "sqljdbc.jar"
11+
apiname: "SQLServerConnection.prepareStatement (java.lang.String, int[])"
12+
apitype: "Assembly"
13+
---
14+
# prepareStatement method (java.lang.String, int[])
15+
16+
[!INCLUDE[Driver_JDBC_Download](../../../includes/driver_jdbc_download.md)]
17+
18+
Creates a [SQLServerPreparedStatement](../../../connect/jdbc/reference/sqlserverpreparedstatement-class.md) object for sending parameterized SQL statements to the database, and that's capable of returning the autogenerated keys designated by the given array.
19+
20+
## Syntax
21+
22+
```java
23+
public java.sql.PreparedStatement prepareStatement(java.lang.String sql,
24+
int[] columnIndexes)
25+
```
26+
27+
#### Parameters
28+
29+
`sql`
30+
31+
A **String** that contains a SQL statement.
32+
33+
`columnIndexes`
34+
35+
An array of ints.
36+
37+
## Return value
38+
39+
A PreparedStatement object.
40+
41+
## Exceptions
42+
43+
[SQLServerException](../../../connect/jdbc/reference/sqlserverexception-class.md)
44+
45+
## Remarks
46+
47+
This prepareStatement method is specified by the prepareStatement method in the java.sql.Connection interface.
48+
49+
## Related content
50+
51+
- [prepareStatement Method (SQLServerConnection)](../../../connect/jdbc/reference/preparestatement-method-sqlserverconnection.md)
52+
- [SQLServerConnection Members](../../../connect/jdbc/reference/sqlserverconnection-members.md)
53+
- [SQLServerConnection Class](../../../connect/jdbc/reference/sqlserverconnection-class.md)

‎docs/connect/jdbc/reference/preparestatement-method-java-lang-string-int.md‎

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,37 @@
11
---
2-
title: "prepareStatement Method (java.lang.String)"
3-
description: "prepareStatement Method (java.lang.String)"
2+
title: "prepareStatement Method (java.lang.String, int)"
3+
description: "prepareStatement Method (java.lang.String, int)"
44
author: David-Engel
55
ms.author: davidengel
6-
ms.date: "02/07/2017"
6+
ms.date: "01/22/2026"
7+
ai-usage: ai-assisted
78
ms.service: sql
89
ms.subservice: connectivity
910
ms.topic: reference
1011
apilocation: "sqljdbc.jar"
11-
apiname: "SQLServerConnection.prepareStatement (java.lang.String)"
12+
apiname: "SQLServerConnection.prepareStatement (java.lang.String, int)"
1213
apitype: "Assembly"
1314
---
14-
# prepareStatement Method (java.lang.String)
15+
# prepareStatement Method (java.lang.String, int)
1516

16-
Creates a [SQLServerPreparedStatement](./sqlserverpreparedstatement-class.md) object for sending parameterized SQL statements to the database.
17+
Creates a [SQLServerPreparedStatement](./sqlserverpreparedstatement-class.md) object that has the capability to retrieve autogenerated keys.
1718

1819
## Syntax
1920

2021
```
21-
public java.sql.PreparedStatement prepareStatement(java.lang.String sql)
22+
public java.sql.PreparedStatement prepareStatement(java.lang.String sql,
23+
int autoGeneratedKeys)
2224
```
2325

2426
#### Parameters
25-
*sql*
27+
`sql`
2628

2729
A **String** containing a SQL statement.
2830

31+
`autoGeneratedKeys`
32+
33+
An **int** flag indicating whether autogenerated keys should be returned. One of `Statement.RETURN_GENERATED_KEYS` or `Statement.NO_GENERATED_KEYS`.
34+
2935
## Return Value
3036
A PreparedStatement object.
3137

@@ -35,10 +41,8 @@ A PreparedStatement object.
3541
## Remarks
3642
This prepareStatement method is specified by the prepareStatement method in the java.sql.Connection interface.
3743

38-
## See Also
39-
40-
[prepareStatement Method (SQLServerConnection)](./preparestatement-method-sqlserverconnection.md)
41-
42-
[SQLServerConnection Members](./sqlserverconnection-members.md)
44+
## Related content
4345

44-
[SQLServerConnection Class](./sqlserverconnection-class.md)
46+
- [prepareStatement Method (SQLServerConnection)](./preparestatement-method-sqlserverconnection.md)
47+
- [SQLServerConnection Members](./sqlserverconnection-members.md)
48+
- [SQLServerConnection Class](./sqlserverconnection-class.md)

‎docs/connect/jdbc/reference/preparestatement-method-java-lang-string.md‎

Lines changed: 38 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,49 @@
11
---
2-
title: "prepareStatement Method (java.lang.String, int[])"
3-
description: "prepareStatement Method (java.lang.String, int[])"
2+
title: "prepareStatement Method (java.lang.String)"
3+
description: "prepareStatement Method (java.lang.String)"
44
author: David-Engel
55
ms.author: davidengel
6-
ms.date: "01/19/2017"
6+
ms.date: "01/22/2026"
77
ms.service: sql
88
ms.subservice: connectivity
99
ms.topic: reference
1010
apilocation: "sqljdbc.jar"
11-
apiname: "SQLServerConnection.prepareStatement (java.lang.String, int[])"
11+
apiname: "SQLServerConnection.prepareStatement (java.lang.String)"
1212
apitype: "Assembly"
13+
ai-usage: ai-assisted
1314
---
14-
# prepareStatement Method (java.lang.String, int[])
15+
# prepareStatement Method (java.lang.String)
16+
1517
[!INCLUDE[Driver_JDBC_Download](../../../includes/driver_jdbc_download.md)]
1618

17-
Creates a [SQLServerPreparedStatement](../../../connect/jdbc/reference/sqlserverpreparedstatement-class.md) object for sending parameterized SQL statements to the database, and that is capable of returning the auto-generated keys designated by the given array.
18-
19-
## Syntax
20-
21-
```
22-
23-
public java.sql.PreparedStatement prepareStatement(java.lang.String sql,
24-
int[] columnIndexes)
25-
```
26-
27-
#### Parameters
28-
*sql*
29-
30-
A **String** that contains a SQL statement.
31-
32-
*columnIndexes*
33-
34-
An array of ints.
35-
36-
## Return Value
37-
A PreparedStatement object.
38-
39-
## Exceptions
40-
[SQLServerException](../../../connect/jdbc/reference/sqlserverexception-class.md)
41-
42-
## Remarks
43-
This prepareStatement method is specified by the prepareStatement method in the java.sql.Connection interface.
44-
45-
## See Also
46-
[prepareStatement Method (SQLServerConnection)](../../../connect/jdbc/reference/preparestatement-method-sqlserverconnection.md)
47-
[SQLServerConnection Members](../../../connect/jdbc/reference/sqlserverconnection-members.md)
48-
[SQLServerConnection Class](../../../connect/jdbc/reference/sqlserverconnection-class.md)
49-
50-
19+
Creates a [SQLServerPreparedStatement](../../../connect/jdbc/reference/sqlserverpreparedstatement-class.md) object for sending parameterized SQL statements to the database.
20+
21+
## Syntax
22+
23+
```java
24+
public java.sql.PreparedStatement prepareStatement(java.lang.String sql)
25+
```
26+
27+
#### Parameters
28+
29+
`sql`
30+
31+
A **String** that contains a SQL statement.
32+
33+
## Return Value
34+
35+
A PreparedStatement object.
36+
37+
## Exceptions
38+
39+
[SQLServerException](../../../connect/jdbc/reference/sqlserverexception-class.md)
40+
41+
## Remarks
42+
43+
This prepareStatement method is specified by the prepareStatement method in the java.sql.Connection interface.
44+
45+
## Related content
46+
47+
- [prepareStatement Method (SQLServerConnection)](../../../connect/jdbc/reference/preparestatement-method-sqlserverconnection.md)
48+
- [SQLServerConnection Members](../../../connect/jdbc/reference/sqlserverconnection-members.md)
49+
- [SQLServerConnection Class](../../../connect/jdbc/reference/sqlserverconnection-class.md)

‎docs/connect/jdbc/reference/preparestatement-method-sqlserverconnection.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ apitype: "Assembly"
2222
|----------|-----------------|
2323
|[prepareStatement (java.lang.String)](../../../connect/jdbc/reference/preparestatement-method-java-lang-string.md)|Creates a [SQLServerPreparedStatement](../../../connect/jdbc/reference/sqlserverpreparedstatement-class.md) object for sending parameterized SQL statements to the database.|
2424
|[prepareStatement (java.lang.String, int)](../../../connect/jdbc/reference/preparestatement-method-java-lang-string-int.md)|Creates a [SQLServerPreparedStatement](../../../connect/jdbc/reference/sqlserverpreparedstatement-class.md) object for sending parameterized SQL statements to the database, and has the capability to retrieve auto-generated keys.|
25-
|[prepareStatement (java.lang.String, int[])](../../../connect/jdbc/reference/preparestatement-method-java-lang-string.md)|Creates a [SQLServerPreparedStatement](../../../connect/jdbc/reference/sqlserverpreparedstatement-class.md) object for sending parameterized SQL statements to the database, and that is capable of returning the auto-generated keys that are designated by the given array.|
25+
|[prepareStatement (java.lang.String, int[])](../../../connect/jdbc/reference/preparestatement-method-java-lang-string-int-array.md)|Creates a [SQLServerPreparedStatement](../../../connect/jdbc/reference/sqlserverpreparedstatement-class.md) object for sending parameterized SQL statements to the database, and that is capable of returning the auto-generated keys that are designated by the given array.|
2626
|[prepareStatement (java.lang.String, int, int)](../../../connect/jdbc/reference/preparestatement-method-java-lang-string-int-int.md)|Creates a [SQLServerPreparedStatement](../../../connect/jdbc/reference/sqlserverpreparedstatement-class.md) object that generates [SQLServerResultSet](../../../connect/jdbc/reference/sqlserverresultset-class.md) objects with the given type and concurrency.|
2727
|[prepareStatement (java.lang.String, int, int, int)](../../../connect/jdbc/reference/preparestatement-method-java-lang-string-int-int-int.md)|Creates a [SQLServerPreparedStatement](../../../connect/jdbc/reference/sqlserverpreparedstatement-class.md) object that generates [SQLServerResultSet](../../../connect/jdbc/reference/sqlserverresultset-class.md) objects with the given type, concurrency, and holdability.|
2828
|[prepareStatement (java.lang.String, java.lang.String[])](../../../connect/jdbc/reference/preparestatement-method-java-lang-string-java-lang-string.md)|Creates a [SQLServerPreparedStatement](../../../connect/jdbc/reference/sqlserverpreparedstatement-class.md) object for sending parameterized SQL statements to the database.|

‎docs/connect/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -923,6 +923,8 @@
923923
href: ../connect/jdbc/reference/preparestatement-method-java-lang-string.md
924924
- name: prepareStatement Method (java.lang.String, int)
925925
href: ../connect/jdbc/reference/preparestatement-method-java-lang-string-int.md
926+
- name: prepareStatement Method (java.lang.String, int[])
927+
href: ../connect/jdbc/reference/preparestatement-method-java-lang-string-int-array.md
926928
- name: prepareStatement Method (java.lang.String, int, int)
927929
href: ../connect/jdbc/reference/preparestatement-method-java-lang-string-int-int.md
928930
- name: prepareStatement Method (java.lang.String, int, int, int)

‎docs/database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ title: Register a Service Principal Name for Kerberos Connections
33
description: "Find out how to register a Service Principal Name (SPN) with Active Directory. This registration is required for using Kerberos authentication with SQL Server."
44
author: rwestMSFT
55
ms.author: randolphwest
6-
ms.date: 08/26/2025
6+
ms.date: 01/22/2026
7+
ai-usage: ai-assisted
78
ms.service: sql
89
ms.subservice: configuration
910
ms.topic: how-to
@@ -100,9 +101,9 @@ For a TCP/IP connection, where the TCP port is included in the SPN, [!INCLUDE [s
100101

101102
When an instance of the [!INCLUDE [ssDEnoversion](../../includes/ssdenoversion-md.md)] starts, [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] tries to register the SPN for the [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] service. When the instance is stopped, [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] tries to unregister the SPN. For a TCP/IP connection, the SPN is registered in the format `MSSQLSvc/<FQDN>:<tcpport>`. Both named instances and the default instance are registered as `MSSQLSvc`, relying on the `<tcpport>` value to differentiate the instances.
102103

103-
For other connections that support Kerberos the SPN is registered in the format `MSSQLSvc/<FQDN>:<instancename>` for a named instance. The format for registering the default instance is `MSSQLSvc/<FQDN>`.
104+
For other connections that support Kerberos, the SPN is registered in the format `MSSQLSvc/<FQDN>:<instancename>` for a named instance. The format for registering the default instance is `MSSQLSvc/<FQDN>`.
104105

105-
To give permissions to the [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] startup account, to register and modify the SPN, perform the following steps:
106+
To give permissions to the [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] startup account to register and modify the SPN, perform the following steps:
106107

107108
1. On the Domain Controller machine, navigate to **Active Directory Users and Computers**.
108109

@@ -116,9 +117,9 @@ To give permissions to the [!INCLUDE [ssnoversion-md](../../includes/ssnoversion
116117

117118
1. Select the account and select **Edit**.
118119

119-
1. Under Permissions select **Validated Write servicePrincipalName**.
120+
1. Under Permissions select **Validated write to service principal name**.
120121

121-
1. Scroll down and under **Properties** select:
122+
1. Scroll down and under **Properties**, select:
122123

123124
- **Read servicePrincipalName**
124125
- **Write servicePrincipalName**
@@ -200,7 +201,7 @@ The following table describes the authentication defaults that are used, based o
200201
201202
## Remarks
202203

203-
The Dedicated Administrator Connection (DAC) uses an instance name-based SPN. Kerberos authentication can be used with a DAC if that SPN is registered successfully. As an alternative a user can specify the account name as an SPN.
204+
The Dedicated Administrator Connection (DAC) uses an instance name-based SPN. Kerberos authentication can be used with a DAC if that SPN is registered successfully. As an alternative, you can specify the account name as an SPN.
204205

205206
If SPN registration fails during startup, this failure is recorded in the [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] error log, and startup continues.
206207

0 commit comments

Comments
 (0)