diesel::sql_query built from format! interpolates untrusted values into raw SQL.
Bind parameters with .bind() rather than interpolating into the SQL string.