This can never be null, and there's no reason to pass that as a variable.
ACTUALLY handle SQL passwords (or other fields) with '#' in them properly.