How Prepared Statement Prevents Sql Server