String can be created in multiple ways
- By using one of thirteen constructors provided by String class (or using new keyword)
- By using '=' operator (or String literal)
Important difference between them is when we create String object using String literal JVM checks string pool if found string object will be returned else new object will be created; but in case of new JVM will create new object without checking in string pool.
String equal method check each character in character array that is present inside String; where as '==' checks object memory location.
String pool is special memory location where JVM keeps all string objects
String and security:
If we keep sensitive data in String due to immutable nature we can't erase that data. Someone who got access to java memory like access to heap dump can read that information.
We should keep password in char array and reset them once they are no longer needed.
By default String will use same encoding as underlaying platform i.e. character encoding of server. This can cause issues if server is not supporting unicode encoding like UTF-8 or UTF-16. This can be changed by using system property "file.encoding"