Definition
Plain language
A way of asking a database a question that keeps the user's words strictly separate from the instructions, so they can never be mistaken for commands.
As stated in the literature
A prepared statement where user data is bound as typed parameters rather than concatenated into SQL text, structurally preventing SQL injection; the analogous defense does not exist for natural-language prompts.
Also called: parameterize, parameterized queries
Why it matters: It is the clearest existing example of solving an injection problem by design rather than by filtering, and the absence of any equivalent for natural-language prompts is why prompt injection remains unsolved.
For example, if someone types "'; DROP TABLE users;--" into a search box, a parameterized query treats the whole string as a name to look up rather than as a command to delete the table.
Heard on the show
“The difference is that SQL has a formal grammar, so you can escape and parameterize against it.”Episode 236 — Why a Printed 'OPERATOR OVERRIDE' Note Redirects Robot Planners