Is it safe to concat the string here? Or should we parameterize it?