Prepared Statements & Parameters

Prepared statements (also called parameterized queries) are the safe, standard way to run SQL with user-supplied values.

The idea

Write the SQL once with placeholders, then send the values separately. The database never mixes the values into the command text.

SQL Server style

sql - @City is a parameter
SELECT * FROM Customers WHERE City = @City; - In code you then pass the value for @City.

MySQL style

sql
PREPARE stmt FROM 'SELECT * FROM Customers WHERE City = ?';

### SET @city = 'London';

### EXECUTE stmt USING @city;

### DEALLOCATE PREPARE stmt;

In real applications

Apps (in Node.js, Python, Java, etc.) use the database driver's parameter API instead of string concatenation. The driver and database handle escaping automatically.

Why they matter

• Security: blocks SQL injection.
• Performance: the query can be prepared once and reused.
• Clarity: the SQL and the data stay separate.

TL;DR

• Prepared statements use placeholders for values.
• Values are sent separately from the SQL.
• They block SQL injection.
• Every language's database driver supports them.