This SQL Statement should be in a `$wpdb->prepare`

https://codex.wordpress.org/Class_Reference/wpdb