How can I secure my SQL query against SQL injection vulnerabilities