When entered text changes a database request
When someone signs in, a website sends a query to its database. If it mixes text from the form into the query’s instructions, an attacker may change what the database does, such as reveal private records or alter data.
Keep data separate from instructions
Developers use parameterised queries (also called prepared statements) to send instructions and entered values separately. The database then treats those values as data, even if they contain special characters.
Checking input and limiting what the website can do in the database provide extra protection. They do not replace parameterised queries.