結果 : parameterized queries to avoid sql injection