SQL injection
Using a SQL update statement like this one (spacing is optional):

UPDATE players
   SET name = 'Smith, Steve', score = 42, active = TRUE
   WHERE jerseyNum = 99
Non-parameterized SQL is the GoTo statement of database programming. Don't do it, and make sure your coworkers don't either.
 
Module Parametrized_Sql {
	Base "rosetta"  ' warning erase database if found it in current directory
	Execute "rosetta", {create table players (name VarChar(64), score Float, active Integer, jerseyNum Integer);}
	Append "rosetta", "players","name",0,FALSE,99
	sql$={
	UPDATE players
	   SET name = '{0}', score = {1}, active = {2}
	   WHERE jerseyNum = {3}
	}
	Execute "rosetta", format$(sql$,"Smith, Steve", 42,TRUE, 99)
	Retrieve "rosetta","players",1,"jerseyNum",99
	Read how_many
	Read Name$,score, active,jerseynum
	Print Name$="Smith, Steve", score=42, active=True, jerseynum=99  ' true true true true
}
Parametrized_Sql
 