SQL injection
Using a SQL update statement like this one (spacing is optional):

UPDATE players
   SET name = 'Smith, Steve', score = 42, active = TRUE
   WHERE jerseyNum = 99
Non-parameterized SQL is the GoTo statement of database programming. Don't do it, and make sure your coworkers don't either.
-- This works in Oracle's SQL*Plus command line utility
 
VARIABLE P_NAME VARCHAR2(20);
VARIABLE P_SCORE NUMBER;
VARIABLE P_ACTIVE VARCHAR2(5);
VARIABLE P_JERSEYNUM NUMBER;
 
BEGIN
 
:P_NAME := 'Smith, Steve';
:P_SCORE := 42;
:P_ACTIVE := 'TRUE';
:P_JERSEYNUM := 99;
 
END;
/
 
DROP TABLE players;
 
CREATE TABLE players 
(
NAME VARCHAR2(20),
SCORE NUMBER,
ACTIVE VARCHAR2(5),
JERSEYNUM NUMBER
);
 
INSERT INTO players VALUES ('No name',0,'FALSE',99);
 
commit;
 
SELECT * FROM players;
 
UPDATE players
   SET name = :P_NAME, score = :P_SCORE, active = :P_ACTIVE
   WHERE jerseyNum = :P_JERSEYNUM;
 
commit;
 
SELECT * FROM players;