Look up "prepared statements", it's pretty well documented.