We need to be using placeholders here otherwise we're wide open to sql injection.