Use SimpleQuery to protect against bad parameters from client.