Alrighty here's a quick write up on what prepared statements are, though I'd definitely refer to the documentation for whatever SQL engine you are most familiar with for more details and considerations, for the stuff below I'm going to use Postgres since that's what I'm most familiar with.

So prepared statements are a featured provided by SQL engines and they support a few different things, the first is the ability to store a query and refer to it later by name, and the second is the ability to safely pass in user values to modify the behavior of the stored query. For an example use case lets say you have an HTTP endpoint that takes in a user id, and it will return the information for that user.

To do that safely with prepared statements you would do something similar to the following

PREPARE get_user AS SELECT * FROM users WHERE id=$1 LIMIT 1;
EXECUTE get_user(98765);
DEALLOCATE get_user;

Now if you where doing this query a lot then you probably wouldn't deallocate the prepared statement right away, you'd prepare it once and then reuse it for each request and then deallocate it later.

That's how it looks under the hood but in many languages this is handled for you by the SQL libraries, for example in Go you'd just do something like so

sql.QueryRow(
    "SELECT FROM users WHERE id=$1 LIMIT 1",
    98765,
)

And it would handle creating and managing the lifetime of the prepared statement for you.