What are prepared statements and why should you use them?

Prepared statements are pre-compiled SQL templates with parameter placeholders that are separated from data values. Two-step execution: (1) Prepare: send the SQL template to the server for parsing and compilation; (2) Execute: send only the parameter values — the server fills in the placeholders and executes. Syntax in MySQL: PREPARE stmt FROM "SELECT * FROM users WHERE email = ? AND status = ?"; SET @email = "alice@example.com"; SET @status = "active"; EXECUTE stmt USING @email, @status; DEALLOCATE PREPARE stmt;. Benefits: (1) SQL Injection prevention: parameter values are never interpreted as SQL — the structure is fixed at prepare time. Even if a user inputs "1; DROP TABLE users", it's treated as a literal string value; (2) Performance: for queries executed many times with different parameters, parsing/compilation happens once; (3) Type safety: parameters are typed correctly. In application code, use parameterized queries via your database library (PDO with ? placeholders, Node.js mysql2 with ?, Mongoose parameterized queries). NEVER concatenate user input into SQL strings — always use prepared statements or ORMs.