vr
Valued Contributor

Isn't it a bad practice to embed SQL parameters by string formatting?