flawopen.com/SQL Injection/What is a parameterized query?
A parameterized query is like filling out a form with labeled blanks instead of handwriting a whole letter. The database gets the fixed template first — "get the row where id = ___" — and the actual value gets dropped into the blank afterward, in a way that can never change what the template itself says.
A database driver sends a parameterized query to the database in two steps: first, the query's structure (the SQL text with placeholders like ? or %s) is sent and prepared/compiled; then, the actual values are sent separately and bound to those placeholders. Because the structure was already fixed before any value arrived, no value — no matter what characters it contains — can be interpreted as part of the SQL syntax itself.
Escaping tries to neutralize dangerous characters within a value before splicing it into the query text — it's a mitigation applied to a fundamentally risky operation (building SQL as a plain string). Parameterization avoids the risky operation entirely: the value is never part of the query text at any point, so there's no character sequence to escape in the first place.
Closely related — a prepared statement is the database-side object created from the fixed query structure; parameterization is the practice of binding values to it separately. The terms are often used interchangeably.
Only for values (data), not for identifiers like table or column names — those need a different defense, typically an allow-list.