Just prepare it the same way you did the first one, that is, by using placeholders where any data will be provided by variables. Then pass the variables in the execute statement. This will define the variables as parameters and guarantee they will not be used as DDL, DML, or TCL, even if they include malicious values.