Hackers exploited an SQL injection flaw in an application and stole sensitive records from the database. The application developers analyzed the incident and found that "Prepared Statements" were not used properly. In this scenario, "Prepared Statements" refers to which of the following terminologies? A security control, Business impact, Asset, or Threat agent?