Use sql params properly