hello guys, i found that parameterized query and preparedstatement can help in preventing sqlia...but i wonder what is the difference between both of them?? and what about bind variable?? i am quite confuse.....

but correct me if i'm wrong...from what i understand, preparedstatement is a way to do a parameterized query or some sort of parameterized query, and the variable that go to the prepared statement will be bind first... is that right??

thanks..