Use $wpdb->prepare() when building SQL statements.