Editing SQL injection (section)

==== Parameterized statements ====
{{Main|Prepared statement}}
Most development platforms support parameterized statements, also known as placeholders or [[bind variable]]s, to securely handle user input instead of embedding it in SQL queries. These placeholders store only values of a defined type, preventing input from altering the query structure. As a result, SQL injection attempts are processed as unexpected input rather than executable code.  With parametrized queries, SQL code remains separate from user input, and each parameter is passed as a distinct value, preventing it from being interpreted as part of the SQL statement.<ref name=":0" />