WARNING: Query Vulnerable to SQL Injection!

I've never done this before so I hope I'm doing this right! ;)