Snarky sql inject comment.

Just a small tip, but no implementation to security and standard practice because it's just a sample app. Although some people just might take the code here too seriously.