You have to escape the things before they reach the database engine. Prepared statements do this via ? Placeholders but they are hard to read. With this you get

You have to escape the things before they reach the database engine. Prepared statements do this via ? Placeholders but they are hard to read. With this you get named placeholders, much nicer to read.