271
prepared statement
also parameterized query, bind parameter
The SQL string is constant. Values are parameters. Escaping quotes is not that.
What is prepared statement?
A prepared statement sends the query shape and the values separately. The database never parses a value as SQL. String concatenation, format strings, and an ORM method that interpolates a fragment are injection. Escaping quotes misses encodings, identifiers, and the next person who adds one more clause.
Why does prepared statement matter when vibe coding?
The draft glues the name into the SQL string, or calls a raw query with a formatted string. A test name with a quote breaks it. A hostile name changes the query.
How do you do prepared statement?
Parameters for values. If an identifier must vary, choose it from a fixed allowlist in code. Do not escape. Do not build SQL with a template string.
How do you ask a model for prepared statement?
Query (table) with a prepared statement. Bind (values) as parameters. Keep the SQL string constant. Do not concatenate or escape input into the SQL. If a column name varies, pick it from an allowlist.
What goes wrong with prepared statement?
Parameters for values, and a template string for the ORDER BY column. The column is still injection.