So, basically using SQL prepared statements. Which are fine for simple queries where the behavior is always exactly the same, but become very complicated when you outgrow the "one hour blog" demo phase. It's much easier to build queries out of data structures in most languages, and if you're already building a data structure, there's no reason to convert it to a human-editable text form just so it can be parsed again.