SQL injection

An attack where text pasted into a query rewrites it. Passing every request value through a `?` placeholder prevents it.