Use prepared statement to prevent SQL injection.