Pay particular attention to the fact that, in the example above, the question-marks are not enclosed in quotes.   If they were, they’d be seen as a literal character-string consisting of a question mark.   For some strange reason, I whacked my forehead against that quite a few times, in my earlier days.   (Thank you ... I feel so much better now ...)

INSERT and UPDATE statements are two of the biggest reasons for having placeholders, and they’re also one of their biggest beneficiaries.   When you do these things, you’re inserting user-provided data (which might be malicious), and you’re probably doing it thousands of times, maybe under a fairly tight schedule.   So, prepare the statement-handle once, then keep re-using it.

If you are doing many inserts, be sure to do it within a transaction.   (COMMIT periodically if it makes sense to do so.)   This tells the database server that it doesn’t have to ensure that the data has been committed to disk before the statement completes.   For an SQLite database-file, for instance, this simple concern makes a “night vs. day” difference in performance.   Naturally, there are auto_commit features available...