It works by only allowing statically defined strings to be used for SQL /statements/, it still works for dynamic input. https://en.wikipedia.org/wiki/Prepared_

It works by only allowing statically defined strings to be used for SQL /statements/, it still works for dynamic input. https://en.wikipedia.org/wiki/Prepared_statement https://en.wikipedia.org/wiki/Prepared_statement The ? is a placeholder for dynamic values, the user input is bound to it.