como pasar un String a una base de datos

[radian]

Estoy de acuerdo en tus comentarios en cuanto a seguridad y caracteres de escape (aunque estos últimos son muy fáciles de evitar sin necesidad de un preparedStatement). En todo caso te cito una referencia que trata este tema: Java Programming with Oracle JDBC, Donald Bales, O'Reilly:

A Prepared Statement Versus a Statement

It's a popular belief that using a PreparedStatement object to execute a SQL statement is faster than using a Statement object. That's because a PreparedStatement object makes only one round trip to the database to get its data type information when it is first prepared, while a Statement object must make an extra round trip to the database to get its metadata each time
it is executed. So the simple conclusion is that on the second and subsequent executions of a prepared statement, it is 50% faster than a statement. However, due to the overhead of using a PreparedStatement object, it takes at least 65 executions before a PreparedStatement object is faster than a Statement object. For a small number of executions, a PreparedStatement object is not faster than a Statement object.

However, that doesn't mean you shouldn't use a PreparedStatement. On the contrary, if you use the batch capabilities of a PreparedStatement object to execute the same SQL statement many times, it is significantly faster than a Statement object. Oracle's implementation of JDBC implements batching only for PreparedStatement objects, not for Statement objects.

Prepared statements are less dynamic than their statement counterparts; you can build a SQL statement dynamically at runtime, but doing so using a prepared statement requires more coding, and the code required is fairly specific to the task. Prepared statements can, however, greatly simplify formulating your SQL statements, because you don't have to worry about date formats, number formats, or tick characters in strings. And prepared statements allow you to insert or update streaming data types.
The advantages of using prepared statements are that they allow you to improve efficiency by batching, utilize the SQL statement cache in the database to increase its efficiency, simplify your coding, and allow you to insert or update streaming data types.