The way you use prepared statement is actually creating a insert query without telling the driver column types. It can be optimized by changing the query to INSERT INTO device_user (device_type,device ...

INSERT INTO VALUES statement fails to send INSERT clause when preparedStatement SQL is a concatenated string #2469 ...

Java's PreparedStatement class can also be helpful for preventing SQL attacks. Java LDAP injections Injection attacks that exploit Lightweight Directory Access Protocol (LDAP) statements represent ...