security considerations while using url parameters in soql as bind variables

Using bind variables automatically takes care of all SOQL injection vulnerabilities, with no extra effort on the part of the developer. You should always use bind variables on any untrusted or unsanitized user input. You can even use simple bind variables on dynamic queries to avoid having to manually escape special characters.

String query = 'select id, name from lead where name = :leadName';
Lead[] records = Database.query(query);

You can't evaluate Apex Code in dynamic queries, though, so that means you can't use something like:

String query = 'select id, name from lead where id in :leads.keySet()';

You can reference a set or list, but you can't reference a single element in a list, for example. If you need to use page parameters from a Visualforce page, for example, you'll have to pull them out into individual variables that you can reference, if you're using dynamic queries.

String searchName = ApexPages.currentPage().getParameters().get('name');
String query = 'select id, name from lead where name = :searchName';
Lead[] records = Database.query(query);

For inline queries, you can inline complex code if you desire:

Lead[] records = [select id, name from lead 
                  where name = :ApexPages.currentPage().getParameters().get('name')];