thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Data & Analytics · Intermediate

Parameterized Query

A query that uses placeholders for input values that are bound separately, so the input is never treated as SQL code.

Definition

Parameterized queries, also called prepared statements or bind variables, are the primary defense against SQL injection. They also allow the database to reuse cached execution plans. Parameter sniffing in SQL Server can cause a plan compiled for one value to perform poorly for others.

Example

cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

Exam tip

The best defense against SQL injection is parameterized queries, not input escaping alone.

Related terms