Raw SQL executed with string-interpolated or concatenated user input allows SQL injection.
Use parameterized queries with whereArgs or positional argument lists instead of interpolation.