How does a PreparedStatement avoid or prevent SQL injection?

Question

I know that PreparedStatements avoid/prevent SQL Injection. How does it do that? Will the final form query that is constructed using PreparedStatements will be a string or otherwise?

Answer 1

Try using the below code:

PreparedStatement stmt = conn.createStatement("INSERT INTO students VALUES('" + user + "')");

stmt.execute();

Otherwise, use the below code:

PreparedStatement stmt = conn.prepareStatement("INSERT INTO student VALUES(?)");

stmt.setString(1, user);

stmt.execute();

Note: If the "user" came from user input and the user input was like 

Robert'); DROP TABLE students; --