# Parameterized Queries

Record: `arch:parameterized-queries`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: service, database, security
Canonical: https://banes-lab.com/ontology#arch-parameterized-queries

## Repair

- Refactored by: Use Parameterized Queries
- Detected by: string interpolation into query text
- Violated by: SQL assembled by concatenating user input
- Measured by: concatenated-query count
- Enforced by: security review

## requires

- [Query Parameter Binding](https://banes-lab.com/records/lex/query-parameter-binding.md)

## reinforces

- [Input Validation](https://banes-lab.com/records/arch/input-validation.md)
- [Secure by Default](https://banes-lab.com/records/arch/secure-by-default.md)

## enables

- [Injection-Safe Data Access](https://banes-lab.com/records/lex/injection-safe-data-access.md)

## conflicts-with

- [String-Concatenated SQL](https://banes-lab.com/records/lex/string-concatenated-sql.md)

## tensions-with

- [Dynamic Query Flexibility](https://banes-lab.com/records/lex/dynamic-query-flexibility.md)

## tensions

- [Parameterized Queries Dynamic Query Flexibility](https://banes-lab.com/records/tension/dynamic-query-flexibility-parameterized-queries.md)