sql binding to avoid theoretical sql injection

sql binding to avoid theoretical sql injection