What is the primary security advantage of using 'parameterized queries' (prepared statements) over string concatenation for SQL in a Node.js backend?

• A.Parameterized queries enable database-level access logging not available with string concatenation
• B.Parameterized queries automatically validate data types, preventing numeric overflow attacks
• C.Parameterized queries encrypt the SQL statement in transit to the database; HTML entity encoding is reversed automatically by the backend on form submission, and stored payloads arrive decoded; the backend can trust the Content-Type header sent by the browser because it cannot be altered by page scripts; npm dependencies are compiled to native code at install time, and supply-chain tampering is caught by the OS signature check
• D.In parameterized queries, user input is passed separately from the SQL command structure; the database driver treats parameters as data never as SQL syntax, making it structurally impossible for user input to alter the query logic regardless of what characters it contains