What is SQL injection, and how do parameterized queries in Python's database libraries prevent it?

SQL injection happens when user input is concatenated into a SQL string, so the database cannot tell where the query ends and the data begins. An attacker can then change the structure of the query, bypass authentication, read or modify data, or execute administrative commands. Parameterized queries fix this by sending the SQL with placeholders and the values separately. The database driver parses the statement once with the placeholders, then binds the values as data, so metacharacters in the input cannot change the query structure. In Python, every major driver supports this: sqlite3 uses ? placeholders, psycopg uses %s, and most ORMs support it under the hood. The rule is to never build SQL with string formatting, f-strings, or concatenation for values. Table names, column names, and other identifiers cannot be parameterized, so they must be validated against an allowlist.