The string construction issue is called "parameterized queries", if you want to look it up @GabiThume :)
Not using these is a very common vector for SQL injection attacks, since it's very easy to accidentally let untrusted data into a string. 

Some people will tell you that running a regex or some kind of escaping or "safe" function on the data first is good enough - these people are wrong :P