Exercise 3: Why Placeholders Matter for Security — Possible Solution
====================================================================

WHY THE ? PLACEHOLDERS MATTER
------------------------------
Parameterized placeholders keep the actual data values completely separate from the SQL command's own structure. better-sqlite3 sends the query text and the values to the database separately, so a value can never be interpreted as part of the SQL syntax itself, no matter what characters it contains.

WHAT WOULD HAPPEN WITH STRING CONCATENATION INSTEAD
------------------------------
If a value were concatenated directly into the SQL string instead - for example building the query as "INSERT INTO items (name) VALUES ('" + name + "')" - a malicious or malformed value could break out of the intended string and inject its own SQL. A name value like "'); DROP TABLE items; --" concatenated directly would change the actual meaning of the executed SQL statement, a classic SQL injection vulnerability.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly explains that placeholders keep data and SQL structure separate so a value can never be interpreted as SQL syntax, and correctly describes SQL injection as the specific, concrete risk that string concatenation would introduce instead.