[codedokode]

One usually uses "query builder" pattern for that.

Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.

[Yokohiii]

ORMs and query builders ARE concatenating strings.

[codedokode]

But in a safe manner.

[Yokohiii]

You can do that too.