Did anyone else notice the sql injection in their first block of code?