SQL injection
Using a SQL update statement like this one (spacing is optional):

UPDATE players
   SET name = 'Smith, Steve', score = 42, active = TRUE
   WHERE jerseyNum = 99
Non-parameterized SQL is the GoTo statement of database programming. Don't do it, and make sure your coworkers don't either.
\ assuming the var 'db' contains an opened database with a schema matching the problem:
db @ 
"UPDATE players SET name=?1,score=?2,active=?3 WHERE jerseyNum=?4"
db:prepare var, stmt
 
\ bind values to the statement:
stmt @ 1 "Smith, Steve" db:bind
       2 42 db:bind
       3 true db:bind
       4 99 db:bind
 
\ execute the query
db @  swap db:exec