# Parameterized Queries

> A mechanism that sends query text and values to the database separately, so values are never parsed as query syntax.

Record: `architecture:parameterized-queries`
Kind: mechanism
Layer: [Security Core](https://banes-lab.com/records/layer/security-core.md)
Severity: mandatory
Scope: service, database, security
Canonical: https://banes-lab.com/ontology#architecture-parameterized-queries

Listed in [Architecture principles](https://banes-lab.com/api/records/architecture.md), after [CSRF Protection](https://banes-lab.com/records/architecture/csrf-protection.md) and before [Session Management](https://banes-lab.com/records/architecture/session-management.md).

## Repair

- Refactored by: Use Parameterized Queries
- Detected by: string interpolation into query text
- Violated by: SQL assembled by concatenating user input
- Measured by: concatenated-query count
- Enforced by: security review

## Requires

- [Query Parameter Binding](https://banes-lab.com/records/lexicon/query-parameter-binding.md)

## Reinforces

- [Input Validation](https://banes-lab.com/records/architecture/input-validation.md)
- [Secure by Default](https://banes-lab.com/records/architecture/secure-by-default.md)

## Enables

- [Injection-Safe Data Access](https://banes-lab.com/records/lexicon/injection-safe-data-access.md)

## Conflicts with

- [String-Concatenated SQL](https://banes-lab.com/records/lexicon/string-concatenated-sql.md)

## In tension with

- [Dynamic Query Flexibility](https://banes-lab.com/records/lexicon/dynamic-query-flexibility.md)

## Tensions

- [Parameterized Queries / Dynamic Query Flexibility](https://banes-lab.com/records/tension/dynamic-query-flexibility-parameterized-queries.md)

## Severity

- [mandatory](https://banes-lab.com/records/vocabulary/severity-mandatory.md)

## Category

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/records/architecture-category/security-privacy-compliance-governance.md)

## Linked from

- [Security / Privacy / Compliance / Governance](https://banes-lab.com/ontology/principles/architecture-category-security-privacy-compliance-governance.md)
- [Security Privacy Compliance](https://banes-lab.com/ontology/lexicon/lexicon-category-security-privacy-compliance.md)
- [Severity levels](https://banes-lab.com/ontology/schema/the-vocabulary-severity.md)
- [The resolutions](https://banes-lab.com/ontology/schema/the-resolutions.md)