結果 : how does parameterization prevent sql injection