Building a SQL string with format! and passing it to query/execute allows injection.
Use parameterized queries with bind parameters instead of building SQL via format!.