SQL injection
Using a SQL update statement like this one (spacing is optional):

UPDATE players
   SET name = 'Smith, Steve', score = 42, active = TRUE
   WHERE jerseyNum = 99
Non-parameterized SQL is the GoTo statement of database programming. Don't do it, and make sure your coworkers don't either.
 
--#SET TERMINATOR @
 
CREATE TABLE PLAYERS (
  NAME VARCHAR(32),
  SCORE INT,
  ACTIVE SMALLINT,
  JERSEYNUM INT
) @
 
CREATE PROCEDURE UPDATE_PLAYER (
  IN PLAYER_NAME VARCHAR(32),
  IN PLAYER_SCORE INT,
  IN PLAYER_ACTIVE SMALLINT,
  IN JERSEY_NUMBER INT
  )
 BEGIN
  UPDATE PLAYERS
  SET NAME = PLAYER_NAME, SCORE = PLAYER_SCORE, ACTIVE = PLAYER_ACTIVE
  WHERE JERSEYNUM = JERSEY_NUMBER;
 END @
 
INSERT INTO PLAYERS VALUES ('Pele', '1280', 0, 10) @
 
CALL UPDATE_PLAYER ('Maradona', '600', 1, 10) @
 
SELECT * FROM PLAYERS @
 