Update ancient code to use parameterized queries