Parameterized query
A parameterized query is a database statement with placeholders whose values are supplied separately from the statement text as data.
ScyllaDB in Action
A pre-parsed database statement whose structure is cached so that it can be executed repeatedly with separately bound parameter values.
- How it is used
- Uses prepared statements for repeated application reads and writes while binding request-specific values safely.
- How deep it goes
- Explains preparation, placeholders, binding, caching, sanitization, and statement-level consistency overrides without driver internals.
- Examples
- Demonstrates article lookup by UUID, author retrieval, article inserts, summary-table inserts, and a curl API response.
- What you can do after
- Apply it via the Scylla Python driver to reuse CQL safely and configure default or per-execution consistency.
Grokking Web Application Security
A parameterized statement is a database command whose structure is fixed separately from the dynamic values bound to it.
- How it is used
- Protects database calls that accept untrusted values from SQL injection.
- How deep it goes
- Explains placeholders, separate binding, attack consequences, ORM use, and allow-listing for dynamic query structure.
- Examples
- Uses login authentication, book CRUD queries, dynamic ordering, Java prepared statements, Rails conditions, and Couchbase SQL++ queries.
- What you can do after
- Apply it via database-driver or ORM placeholder APIs while allow-listing any dynamically generated SQL structure.
Read how Grokking Web Application Security explains parameterized query →
Build Financial Software with Generative AI (From Scratch)
A parameterized query is a database query whose SQL structure is separated from values supplied as parameters.
- How it is used
- Protects ACH-file metadata inserts from SQL injection while storing uploaded filenames and hashes.
- How deep it goes
- Demonstrates a placeholder-based INSERT and contrasts it with interpolated SQL, without detailing database-driver internals.
- Examples
- Uses an `ach_files` INSERT with a filename and MD5 hash, plus cleanup-oriented database tests.
- What you can do after
- Apply it via psycopg to insert uploaded-file metadata without interpolating values into SQL.
Read how Build Financial Software with Generative AI (From Scratch) explains parameterized query →
Secure APIs
A parameterized query is a database query whose code and externally supplied values are transmitted separately so values cannot alter the query structure.
- How it is used
- Mitigates SQL injection when APIs transfer user-controlled values into database queries.
- How deep it goes
- Connects parameterization to unconstrained input and mitigation, but defers database-driver implementation details.
- Examples
- Uses product filters, time-delay payloads, and constrained sortBy values to demonstrate attacks and defenses.
- What you can do after
- Apply parameterization alongside input constraints and fuzz testing when implementing API database access.
Coding with AI
A parameterized query is a database query whose values are supplied separately from the query structure to reduce injection risk and improve safe query execution.
- How it is used
- Uses separated query values to reduce SQL injection risk during Python database CRUD operations.
- How deep it goes
- Defines placeholder-based execution and review requirements, but does not descend into database-driver internals.
- Examples
- Demonstrates a MySQL users-table insert using %s placeholders and separately supplied name and age values.
- What you can do after
- Apply it via mysql.connector to write safer database operations and recognize unsafe string-concatenated SQL.
ASP.NET Core in Action, 3e
A parameterized query separates user-supplied values from the SQL command structure so the values are not interpreted as SQL code.
- How it is used
- Protects database requests from SQL injection when application input is used in queries.
- How deep it goes
- Explains the security principle and demonstrates placeholder-based EF Core usage, without detailing driver-level parameter binding internals.
- Examples
- Uses an EF Core recipe search, unsafe string concatenation, a malicious DROP TABLE value, and a placeholder-based correction.
- What you can do after
- Apply it via EF Core or ADO.NET when writing database queries that include user input.
Read how ASP.NET Core in Action, 3e explains parameterized query →
DuckDB in Action
A parameterized query contains placeholders in its statement text, with actual input values supplied separately to the query engine.
- How it is used
- Uses separate input values to make DuckDB queries reusable and safer in Python data workflows and interactive applications.
- How deep it goes
- Explains placeholders, injection risks, parsing benefits, execution, and result retrieval without detailing database internals.
- Examples
- Demonstrates a GDP threshold count and a Streamlit tennis-player search using named parameters.
- What you can do after
- Apply it via DuckDB's execute function to safely run dynamic SQL and fetch results in Python applications.
Generative AI in Action
A prepared statement is a parameterized database query whose SQL structure is defined separately from the supplied data values.
- How it is used
- Reduces injection risk when applications execute LLM-generated SQL or pass user input into chatbot prompts.
- How deep it goes
- Recommends prepared statements and related safeguards, but provides no implementation steps or API details.
- Examples
- Uses a malicious report request that could produce DROP TABLE SQL and describes placeholders for chatbot input.
- What you can do after
- Apply prepared statements with validation, restricted database permissions, and audits to reduce risks from malicious generated SQL.
Read how Generative AI in Action explains parameterized query →
Related concepts
- SQL injectionaddresses · SQL injection is an attack in which crafted, untrusted input alters the structure or meaning of a SQL statement, potentially causing unintended database operations.
- concatenationcontrasts with · Concatenation is the operation of joining ordered sequences end to end to form a single sequence.
- SQLused by · SQL is a standardized declarative language for defining, querying, and manipulating data and structures in relational database systems.
- injection attackaddresses · An injection attack is a security attack in which crafted or untrusted input is interpreted as commands, code, or query structure by a target system.
- placeholderuses · A placeholder is a temporary or symbolic stand-in for a value, content, component, or position that is supplied, replaced, or resolved later.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.