You should use the ? syntax to bind parameters, so that you can get proper escaping etc