rol over the inputs
or they still result in parameterized queries. If not you have opened yourself up
to an sql injection attack.
</p>

<p>
If you are not using s-sql, then it becomes easy. The query macro
assumes that everything that is not a list starting with a keyword will
evaluate to a string. That means you can build it with a simple format
string
</p>
<div class="org-src-container">
<pre class="src src-lisp">(query (format nil <span style="color: #cd8162;">"select ~a from ~a where ~a"</span>  <span s