A parameterised query is a database statement that keeps the SQL code and the user-supplied values separate. The application sends the query structure first, then binds input as data rather than text to be executed. This prevents special characters in user input from changing the meaning of the query.
It matters because SQL injection usually succeeds when an attacker can break out of a string and alter the database command. Parameterised queries stop that class of bug at the source, making them one of the strongest defenses for login forms, search fields, and any feature that touches a database. In real systems, defenders prefer them over ad hoc escaping, which is often brittle and easy to bypass. They are especially important in pre-authentication paths, where untrusted input reaches server-side logic before a user is logged in.