A parameterized query keeps SQL structure separate from supplied data values. This helps prevent user input or malicious LLM-generated SQL from changing the intended query. One attack example starts with a request to generate a report and produces SQL that could delete the users table. section 13.2.2
For database queries, use prepared statements alongside input and output validation, restricted database permissions, and regular audits. The term is also used for a prompt-injection safeguard: pass user input into a chatbot prompt using placeholders rather than concatenating it directly. These are related injection defenses, but apply to different inputs and systems. section 13.2.2 section 6.6
