Prepared statements are resilient against SQL injection because parameter values don't need to escape correctly. If the original statement template is not derived from external input, then the SQL injection can't occur.