Parameterized Queries

A parameterized query separates the SQL text from the values that go into it. The driver receives the query as a template with placeholders, then sends the values as a separate payload. This habit fixes three problems at once: it stops SQL injection, it handles quoting and escaping correctly, and it lets the database reuse a compiled query plan across many calls. Building SQL with f-strings or + concatenation gets all three wrong.