PreparedStatement如何避免或阻止SQL注入?

I know that PreparedStatements avoid/prevent SQL Injection. How does it do that? Will the final form query that is constructed using PreparedStatements will be a string or otherwise?I know that PreparedStatements avoid/prevent SQ