One usually uses "query builder" pattern for that.

Also, regarding placeholders, historically many DB and frameworks do not support passing lists for a value in a placeholder (like "WHERE id IN(?)") so users of such software fall back to string concatenation.

ORMs and query builders ARE concatenating strings.