Care Pathways reports

http://manage.dimagi.com/default.asp?124276
Not sure where these values are coming from, but these (five lines above) look like they could be vulnerable to SQL injection. Should be using bind parameters, not constructing raw SQL code like that.