Not that I want to write such queries just want to ask what would be the best practice to protect against it