Concatenating variables into a SQL string with + or push_str allows injection.
Use bound parameters instead of concatenating query fragments.