As a countermeasure against SQL injection, why are prepared statements with placeholders (parameterized queries) considered more fundamental than removing dangerous characters from the input?

Answer: C. Because the structure of the SQL statement is fixed first and the input is passed afterward only as values, so whatever characters the input contains, it is never interpreted as part of the command

With a prepared statement, an SQL statement whose values are replaced by symbols (placeholders), such as "SELECT … WHERE id = ? AND password = ?", is first passed to the database to fix its structure, and the input is then attached only as values (binding). The input is treated as data from start to finish, so even if it contains quotation marks it never becomes part of a command, such as one that adds a condition. Removing or escaping dangerous characters requires handling every detailed rule for each database type and character encoding without omission, and a single gap lets the attack succeed. Checks of input in the browser can be bypassed if the attacker sends requests directly without going through a browser, so they serve convenience and are not a security measure. In addition, giving the account used to connect to the database the minimum privileges keeps damage small.

• A. Prepared statements do not encrypt input. The key point is handling the values separately from the SQL statement structure.
• B. Browser-side checks can be bypassed by sending requests directly, so they are not a countermeasure.
• C. Correct. The statement structure is fixed first and the input is handled only as values, so it is never interpreted as a command.