@johnregan3 These database queries need to be using `$wpdb->prepare` so all input values are properly escaped.

http://codex.wordpress.org/Class_Reference/wpdb#Run_Any_Query_on_the_Database