Use named placeholder in order to prevent sql injection