How db_query works when I pass query parameter directly
According to Writing secure code for Drupal 8 (same for D7)

Use the database abstraction layer to avoid SQL injection attacks
Use the database layer correctly. For example, never concatenate data
directly into SQL queries.
Don't do this:
db_query('SELECT foo FROM {table} t WHERE t.name = '. $_GET['user']);

Instead, use proper argument substitution with db_query. The DB layer works on top of PHP PDO and uses an array of named placeholders:
db_query(&quot;SELECT foo FROM {table} t WHERE t.name = :name&quot;, [':name' =&gt; $_GET['user']]);