What is the main security property of a prepared statement with bound parameters?

### Why this is right A prepared statement is parsed separately from its parameter values. Bound values are interpreted as data, rather than being inserted into the SQL command as executable instructions, which prevents the injection mechanism described in the material. ### The concept SQL injection occurs when untrusted input changes the meaning of a database command. Prepared statements preserve the distinction between the command structure and supplied values. Input filtering can supplement this defense but is not a reliable replacement. ### The other options - **B. It grants every application user full database privileges.**: Prepared statements do not control user privileges; broad privileges are a separate risk to avoid. - **C. It hides all database activity from the database server.**: The server receives and processes the prepared command and its values. - **D. It encrypts every database field automatically.**: Prepared statements prevent command injection; they do not automatically encrypt stored data. ### Terms - **Prepared statement**: A database command whose structure is prepared separately from its parameter values. - **Bound parameter**: A value supplied separately to a prepared statement. - **SQL injection**: An attack that changes a database command through unsafe input handling. ### Remember Keep command structure separate from untrusted values.