Adding Placeholders for PHP variables
Better to use PDO for DB related operations in Drupal like db_select(),
db_insert(), db_update() and db_delete().

Here you no need to worry about place holder and other injections.

Ex:
   $result = db_select('node', 'n')
    -&gt;fields('n')
    -&gt;condition('nid', $node-&gt;nid,'=')
    -&gt;condition('status', 0,'&gt;')
    -&gt;condition('uid', array(1,5,7),'IN')
    -&gt;execute()
    -&gt;fetchAssoc();

Note from db_query() API page : Use this function for SELECT queries if it is just a simple query string. If the caller or other modules need to change the query, use db_select() instead.

Do not use this function for INSERT, UPDATE, or DELETE queries. Those should be handled via db_insert(), db_update() and db_delete() respectively.