Best to get in the habit of using `XT.format` with `%1$I` to avoid SQLi vulnerability, even if this particular vector of attack seems farfetched.