The `?` placeholders are bound with `setInt()`, `setString()`, etc. This prevents SQL injection and enables DB2 to reuse the access plan (package cache hit).