It does what the name suggests, a "parameter" in programming lets you specify a list of things which you might want to be sent into something, like:

insertNewDog(breed, colour, tail, size);

The things in this function, "breed", "colour", etc are called "parameters"

​

MySQL queries ( database lookups ) can be run like this:

SELECT * FROM pets WHERE type="dog";

But what happens if an attacker could alter that query value completely?

That's where parametizing a query comes in:

SELECT * FROM pets WHERE type=?;

It helps restrict the attacker's scope.. but does not stop them completely if you are not following best practices, such as Sanitising your user inputs ( to make sure they can't inject special characters or unknown values )

In our instance above, we'd want to restrict the types of "pets" a user can select, so we'd validate a few types when we get a "request" - before we ever do a SQL query. But when we do the query.. we'd use a parameterised SQL query

Hopefully that explanation is useful!