Yes. Preventing SQL injection attacks is very, very easy. To have something like that in your code in 2015 is inexcusable.