SQL Parameters
A parameter represents a value supplied separately by the application. It makes the SQL structure stable and keeps user input from becoming instructions. The placeholder style depends on the driver and database.
Understand the idea
This query uses two named values in a PDO-friendly statement. The application supplies minimum_price and maximum_price when it executes the prepared query. Bind values with the appropriate type and validate the business range as well. Parameter binding prevents a value from changing SQL structure; it does not decide whether the requested range is sensible.
Where to try it
Use PHP PDO for this example. It is shown for reading and local practice; the SQLite browser editor does not run this dialect or supply application-driver parameters. Follow the setup and explanation below in a disposable local environment.
SQLite sample data · MySQL / MariaDB sample data · See the sample tables
A worked example
SELECT product_id, name, price_cents
FROM products
WHERE price_cents >= :minimum_price
AND price_cents <= :maximum_price
ORDER BY price_cents, product_id;
Read the result
With 400 and 1000 bound, Pencil set and Canvas bag match. The example belongs in application code with the driver call; the browser lesson does not pretend to bind missing values automatically.
Try one change
Describe the bound values for a range from 200 to 500 cents, then list the expected matching product names.