two things
1. Pre-made components may have security vulnerabilities that you cannot know about. Make sure you use open source components from a reputable developer.
2. Sometimes SQL has to be generated on the fly. Parameterized queries are your friend.