Yes, that code leaves an unclosed, unreferenced PreparedStatement.
If your driver truly complies with the
JDBC spec, it will be closed when the garbage collector collects it. Also, if your driver is truly JDBC spec compliant, then
if the connection is truly closed (as opposed to being returned to a connection pool), then the PreparedStatement will also be closed when the connection is closed.
You should probably explicitly close it, rather than relying on the "magic" of JDBC. In particular, this code might work well for a long time, then suddenly break when connection pooling is introduced or your garbage collection frequency changes. Similarly, it might pass all
unit tests and fail in a production environment.