Prepared Statements & Parameters

Prepared Statements & Parameters

Prepared statements (also called parameterized queries) are the safe, standard way to run SQL with user-supplied values.

The idea

Write the SQL once with placeholders, then send the values separately. The database never mixes the values into the command text.

SQL Server style

-- @City is a parameter
SELECT * FROM Customers WHERE City = @City;

-- In code you then pass the value for @City.

MySQL style

PREPARE stmt FROM 'SELECT * FROM Customers WHERE City = ?';
SET @city = 'London';
EXECUTE stmt USING @city;
DEALLOCATE PREPARE stmt;

In real applications

Apps (in Node.js, Python, Java, etc.) use the database driver's parameter API instead of string concatenation. The driver and database handle escaping automatically.

Why they matter

• Security: blocks SQL injection.
• Performance: the query can be prepared once and reused.
• Clarity: the SQL and the data stay separate.

TL;DR

• Prepared statements use placeholders for values.
• Values are sent separately from the SQL.
• They block SQL injection.
• Every language's database driver supports them.