Comment by julienreszka

For people wondering how to do this properly it's called parametrized queries.