use placeholder to avoid sqli