To expand this is also a really dumb mistake. It's the equivalent of passing user input directly into a SQL query.