Persisting Prepared Statements
If I understand you correctly, you want to use functions. 

Those are stored (with their code), their execution plans (may be) cached and so on.  Plan caching is not so simple as it first sounds.  Read https://www.postgresql.org/docs/current/static/plpgsql-implementation.html#PLPGSQL-PLAN-CACHING and the linked page about PREPARE.

For the additional questions from your comments, PostgreSQL functions don't necessarily protect you from SQL injection.  Building dynamic SQL statements the wrong way (using concatenation without proper quoting) can still open the possibility for such attacks.