Query parameterization and protection against SQL injections | ORM