You build your SQL statement using named parameters for the values you're going to pass in, and you use your database's client API to create a command and bind

You build your SQL statement using named parameters for the values you're going to pass in, and you use your database's client API to create a command and bind parameter values to it. Then you ask the API to execute the command. The binding step accepts values in your language's native data types, and handles conversions to the database's data types for you in a safe manner.