Can you make sure this is run through `$wpdb->prepare()`?