ODBC libraries typically provide the ability to create parameterized queries that pass the query and parameters to the database separately. This basically eliminates the risk of SQL injection attacks, but is also very convenient from a programming standpoint. Because JMP has ODBC queries, it should also have parameterized queries so that you can do:
Execute SQL(database,
"Select * from Employees where Name like ? and Status=?",
"BobList",
{"Bob", "Active"}
);
pyodbc's parameterized queries:
https://github.com/mkleehammer/pyodbc/wiki/Getting-started#parameters
The .NET ecosystem's parameterized queries:
https://docs.microsoft.com/en-us/dotnet/api/system.data.odbc.odbccommand.parameters?redirectedfrom=M...