Use prepared statements to keep SQL injections at bay.