SQLiteDatabase rawQuery or execSQL called with a Kotlin string template interpolating a variable allows SQL injection.
Use parameterized queries with selectionArgs placeholders instead of interpolating user input into SQL strings.