A parameterized query keeps statement text separate from input values. Placeholders make dynamic queries reusable and prevent supplied strings from changing SQL semantics, reducing SQL injection risk. section 6.2.3
con.execute("""
SELECT count(*)
FROM over_10m
WHERE "GDP ($ per capita)" > $gdp #1
""", {
"gdp":10000 #2
}).fetchone() #3
Pass the GDP threshold separately through DuckDB's Python DB-API execute function, then retrieve the first result with fetchone. section 6.2.3
Interactive player search
A Streamlit application can pass a player search term as the named $search_term parameter. The query searches winner and loser names, returns distinct matches, and supports calls such as search_players("Novak"). section 9.1.2
