SQL injection
Using a SQL update statement like this one (spacing is optional):

UPDATE players
   SET name = 'Smith, Steve', score = 42, active = TRUE
   WHERE jerseyNum = 99
Non-parameterized SQL is the GoTo statement of database programming. Don't do it, and make sure your coworkers don't either.
use IO;
use ODBC;
 
bundle Default {
   class Sql {
      function : Main(args : String[]) ~ Nil {
      conn := Connection->New("ds", "user", "password");
      if(conn <> Nil) {
         sql := "UPDATE players SET name = ?, score = ?, active = ? WHERE jerseyNum = ?";
         pstmt := conn->CreateParameterStatement(sql);
         pstmt->SetVarchar(1, "Smith, Steve");
         pstmt->SetInt(2, 42);
         pstmt->SetBit(3, true);
         pstmt->SetInt(4, 99);
         pstmt->Update()->PrintLine();
         conn->Close();
      };
   }
}