support queryBuilder to avoid security problem like SQL inject

[newcworld]

Now I can only build query from raw string, but it's unsafe for online service because it may accept some invalid input.
Is there a tool that I can use it to build query safely