This opens up the potential for a [SQL injection attack](https://en.wikipedia.org/wiki/SQL_injection) -- please fix, here and below.