so it's impossible that `update[0]` and `update[1]` ever contain `"`? I'm thinking of SQL-like injections here