What is the primary security advantage of using 'parameterized queries' (prepared statements) over string concatenation for SQL in a Node.js backend?

• A.Parameterized queries encrypt user input before it reaches the database: the driver wraps each value in a signed envelope, so the SQL parser never sees the original characters, with every payload neutralized by the cipher before parsing starts in the SQL engine of the server process
• B.Parameterized queries are cached by the database after the first run: the stored execution plan is reused, so attackers are unable to alter the query logic, since the cached plan never changes between requests for the same statement in the connection pool of the application server
• C.Parameterized queries run with fewer privileges: the driver switches to a read-only account, so all injected statements fail at the permission layer, a control that applies even to INSERT calls
• D.In parameterized queries, user input is passed separately from the SQL command structure; the database driver treats parameters as data never as SQL syntax, making it structurally impossible for user input to alter the query logic regardless of what characters it contains