SQL injection: the commented code is actually good.