We need to be using placeholders with `REP3` here. Any values that come from the web service or UI have the potential to be sql injection exploits. The `where_wolf()` function should return both the replace value and a list of placeholders to use with it.