Use prepared statements instead of concatenation.

PreparedStatments should sanitize