How Prepared Statement Prevents Sql Injection Attack