Parameterized Query

A parameterized query (also called a prepared statement with bound parameters) sends the SQL text and the values it operates on to the database separately. The text contains placeholders such as `?` or `:name`, and the values are supplied alongside. The database treats the placeholders as values rather than SQL syntax. Preparing, caching, and recompiling the statement depend on the database and driver. Because values are never parsed as SQL, an input cannot change the structure of the query.