Most (all?) SQL client libraries will allow you indicate a parameter placeholder and supply that parameter value separately.