It doesn't append the strings blindly. Any variables are automatically replaced by placeholder strings. You also get an array of bind parameters. You then use

It doesn't append the strings blindly. Any variables are automatically replaced by placeholder strings. You also get an array of bind parameters. You then use your database library to bind the parameters into the placeholders.