Use prepared statements/parameter binding instead of manual quoting