Q:

What are parameterized queries explained in plain English?

Can anybody explain me in plain English what parametrized queries are and how to implement it in PHP for a MySQL database to avoid SQL injection?

A:

The prepared statements and stored procedures section of the PHP manual, whilst it relates specifically to PDO, covers this well when it says:

They can be thought of as a kind of
  compiled template for the SQL that an
  application wants to run, that can be
  customized using variable parameters.
  Prepared statements offer two major
  benefits:

The query only needs to be parsed (or
  prepared) once, but can be executed
  multiple times with the same or
  different parameters. When the query
  is prepared, the database will
  analyze, compile and optimize it's
  plan for executing the query. For
  complex queries this process can take
  up enough time that it will noticeably
  slow down an application if there is a
  need to repeat the same query many
  times with different parameters. By
  using a prepared statement the
  application avoids repeating the
  analyze/compile/optimize cycle. This
  means that prepared statements use
  fewer resources and thus run faster.
The parameters to prepared statements
  don't need to be quoted; the driver
  automatically handles this. If an
  application exclusively uses prepared
  statements, the developer can be sure
  that no SQL injection will occur
  (however, if other portions of the
  query are being built up with
  unescaped input, SQL injection is
  still possible).

If you're after specific example of how to use them, the above linked page also includes code samples.

