Use prepared statements. No inline sql.