how do i use "?" as variables for my values so that i don't get hacked? I was wondering how do I use question marks so that I don't get hacked because when I use this:
SQL = &quot;INSERT INTO users (id, username) VALUES ( &quot; + message.author.id + &quot;, &quot; + message.author.username + &quot;)&quot;

it gives me an error: Unknown column '(my username)' in 'field list'
I know you will say that there is already a post like this, but I am kinda a beginner still so I don't understand what they are saying
Caution These methods of escaping values only works when the NO_BACKSLASH_ESCAPES SQL mode is disabled (which is the default state for MySQL servers).
In order to avoid SQL Injection attacks, you should always escape any user provided data before using it inside a SQL query. You can do so using the mysql.escape(), connection.escape() or pool.escape() methods:
var userId = 'some user provided value';
var sql    = 'SELECT * FROM users WHERE id = ' + connection.escape(userId);
connection.query(sql, function (error, results, fields) {
  if (error) throw error;
  // ...
});

Escaping-Query-Values