flawopen.com/SQL Injection/What is a parameterized query?
What is a parameterized query, in plain English?
Think of a form with labeled blanks: your program keeps the instructions fixed and asks the database library to place each supplied value in its matching blank. The library may use native server-side preparation or emulate it on the client, but your code should not rewrite the instructions with user input.
The mechanism
With a native server-side prepared statement, the driver prepares SQL containing placeholders and supplies bound values during execution. The protocol and timing depend on the database and driver. Some drivers can emulate preparation on the client; PDO documents this mode explicitly. So the API call alone does not tell you how the value travels. Keep SQL structure fixed, use the driver’s documented binding API, and check whether its native or emulated mode applies.
Why this is different from just "escaping carefully"
Manual escaping asks application code to encode values correctly before concatenation; that is fragile and context-dependent. A parameter-binding API delegates value handling to the driver. With native server-side preparation, values use separate protocol bindings; with emulation, the driver processes placeholders client-side. Keep user input out of application-built SQL strings, and verify the driver’s documented binding behavior.
FAQ
Closely related — a prepared statement is the database-side object created from the fixed query structure; parameterization is the practice of binding values to it separately. The terms are often used interchangeably.
Only for values (data), not for identifiers like table or column names — those need a different defense, typically an allow-list.
References
- OWASP SQL Injection Prevention Cheat Sheet
- flawopen.com — SQL Injection (all languages)
- PHP Manual — PDO::ATTR_EMULATE_PREPARES
- MySQL Reference — COM_STMT_PREPARE
- MySQL Reference — COM_STMT_EXECUTE