title: fat free framework sql sanitization
body: <p>so i'm trying to learn f3 and the database syntax is eluding me. </p>
  
  <p>looking at the <a href="https://github.com/bcosca/fatfree#databases" rel="nofollow">docs</a> it seems that you pass a string of your sql and array of values to replace. but i can't seem to get it working. i have tried just using one parameter, using arrays, not using arrays, etc, etc. eventually i will need to replace 5+ variables in a query so i really need to understand how it works. thanx in advance.</p>
  
  <pre><code>$db = new DB\SQL(
      $f3-&gt;get('db'), 
      $f3-&gt;get('dbuser'), 
      $f3-&gt;get('dbpass')
  );
  $x = $db-&gt;exec(
      "SELECT user_id, email, token FROM `user_primary` WHERE `first_name` = ':first' AND `last_name` = ':last';",
      array(
          ':first' =&gt; $f3-&gt;get('PARAMS.first'),
          ':last' =&gt; $f3-&gt;get('PARAMS.last')
      )
  );
  echo '&lt;pre&gt;'.print_r($x, true).'&lt;/pre&gt;';
  </code></pre>