Comment by benologist

Parameterized queries - gist of it is it stops you concatenating a bunch of your and their strings together to form your SQL statement.