When you are writing SQL

Question

Please write SQL in prepare statement, with users inputs as parameters. Don't use String concate to run SQL command because it may make hacker using SQL injection to attack your DataBase

Answer 1

isn't that where the quote functions jumps in?