A raw SQL query is assembled with the concatenation operator on variable input.
Use parameterized queries with bound placeholders rather than concatenating strings.