Use SQLite3::escapeString() to avoid SQL injection