Database queries should use parameter binding