title: How does a PreparedStatement avoid or prevent SQL injection?
body: <p>I know that PreparedStatements avoid/prevent SQL Injection. How does it do that? Will the final form query that is constructed using PreparedStatements be a string or otherwise?</p>