To avoid sql injection security breach. Is there a way use prepared statement in query ? Please let me know