A query should describe its structure separately from the values supplied by a visitor. Parameter binding lets a database driver treat input as data rather than as part of a command.
Do not assemble SQL with input text
Concatenating a search term into a quoted SQL string can turn punctuation into query syntax. Escaping HTML does not solve this problem because HTML and SQL are different contexts. Use the driver or framework’s parameter-binding interface for values instead of writing your own quoting rules.
Know what a parameter can represent
A bound value is not a substitute for an arbitrary table name, column name or sorting direction. When a user selects an ordering option, map it to a small set of allowed query structures. Keep authorisation separate: a perfectly parameterised query can still expose records that the caller is not allowed to read.
Test the behaviour with difficult input
Include apostrophes, empty input and strings that resemble SQL. Confirm that they are treated as literal values and that access rules still hold. Log enough information to diagnose failures without recording passwords or sensitive personal data. Review every query path, not just the most obvious form submission.
Worked example
The Python example uses sqlite3 placeholders to look up a name containing an apostrophe. The driver binds the name as a value, so the punctuation does not break the query. The same principle applies through a framework’s supported query builder.
import sqlite3
connection = sqlite3.connect(":memory:")
connection.execute("CREATE TABLE learners (name TEXT)")
connection.execute("INSERT INTO learners VALUES (?)", ("O'Neil",))
row = connection.execute("SELECT name FROM learners WHERE name = ?", ("O'Neil",)).fetchone()
print(row[0])
Expected output
O'NeilCheck your understanding
Try each question before opening its explanation. These are free practice prompts; they do not use game chances.
Does parameterisation replace all validation?
No. It separates values from SQL structure. You still need appropriate input limits, business validation and checks that the caller may access the requested data.
Can a placeholder safely choose a table name?
Ordinary value placeholders do not represent SQL identifiers. Choose dynamic identifiers from a deliberate allowlist and build only supported structures.
Why does the apostrophe in O'Neil not require manual SQL quoting here?
The value is supplied separately through the driver’s parameter interface. The driver handles it as data rather than interpolating it into the SQL command text.
Sources and further reading
These original examples explain foundational concepts. Use the official references for complete, current details and version-specific behaviour.
About this guide: AI-assisted educational content with original examples and linked primary references. Found an issue? Tell us what to improve.