Use SQL query parameters rather than hand-quoting values.