查看 this howto 。但是，您应该考虑使用参数化查询，而不是直接传递查询参数。

See this howto. However, you should really consider using parametrized queries instead of passing the query arguments inline.