When creating a query using db_query in my module I want to make sure it's as secure as possible. So I'd like to use placeholders in my 'WHERE' clauses. The problem I'm having is how to use placeholders when the array values to be used are PHP variables. So for example:
WHERE el.field_experience_level_value='$level'
Is what I'm normally using and it works fine. But then I changed it to the following and added the array part at the end like so:
WHERE el.field_experience_level_value=':level'
...some more code
array(':level' => '$level')
I get no error but it doesn't return those results. So my main question is, how do I add a php variable such as $level above (already defined in previous code, not here) to a placeholder?