prevent SQL injection
use sql statement
use prepared statements