an extremely strict whitelist (such as everything that is not alphanumeric or white space). If some special
characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering
step. Be careful of argument injection (CWE-88).
1. CWE-89 : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')