title: How does SQL query parameterisation work?
body: <p>I feel a little silly for asking this since I seem to be the only person in the world who doesn't get it, but here goes anyway.  I'm going to use Python as an example.  When I use raw SQL queries (I usually use ORMs) I use parameterisation, like this example using SQLite:</p>
  
  <p><strong>Method A:</strong></p>
  
  <pre><code>username = "wayne"
  query_params = (username)
  cursor.execute("SELECT * FROM mytable WHERE user=?", query_params)
  </code></pre>
  
  <p>I know this works and I know this is the generally recommended way to do it.  A SQL injection-vulnerable way to do the same thing would be something like this:</p>
  
  <p><strong>Method B:</strong></p>
  
  <pre><code>username = "wayne"
  cursor.execute("SELECT * FROM mytable WHERE user='%s'" % username)
  </code></pre>
  
  <p>As far I can tell I understand SQL injection, as explained in <a href="http://en.wikipedia.org/wiki/Sql_injection" rel="noreferrer">this Wikipedia article</a>.  My question is simply: How is method A really different to method B?  Why is the end result of method A not the same as method B?  I assume that the <code>cursor.execute()</code> method (part of Python's DB-API specification) takes care of correctly escaping and type-checking the input, but this is never explicitly stated anywhere.  Is that all that parameterisation in this context is?  To me, when we say "parameterisation", all that means is "string substitution", like %-formatting.  Is that incorrect?</p>