Is it possible to pass parameters writing a dynamic query? Currently, I use concatenation on the SQL to inject the parameter data but am afraid a user could pass in something that will break the query.

ECMAScript