Web Vulnerabilities
Parameterized Query
Also: prepared statement, bind variable
A database query whose structure is fixed up front, with user values supplied separately as data.
In more detail
Instead of joining a name into a query string, you write the query with a placeholder and pass the value on the side. The database never parses the value as SQL, so no input can change the query. Object-relational mappers use this by default, and are unsafe only where developers drop to raw string building.