Parameterized Query
A security mechanism that separates SQL command templates from user data at the protocol level. The database first compiles the placeholder statement structure and then binds user input as pure data, making SQL injection architecturally impossible.
Core Facts
Timeline (last 90 days)
In parameterized queries, user input exists as placeholders, and values are always parsed as data rather than code, thereby eliminating injection risk.
Protective measures against code execution threats include parameterizing all database queries, sandboxing model-generated code and rejecting network calls, and enforcing strict schema validation.
All Facts (3)
SQL injection can fundamentally isolate data from instructions through parameterized queries, whereas there is currently no equivalent "parameterized" solution for the LLM inference process.
65%UnverifiedIn parameterized queries, user input exists as placeholders, and values are always parsed as data rather than code, thereby eliminating injection risk.
50%UnverifiedProtective measures against code execution threats include parameterizing all database queries, sandboxing model-generated code and rejecting network calls, and enforcing strict schema validation.
50%