SQL injection
Using a SQL update statement like this one (spacing is optional):

UPDATE players
   SET name = 'Smith, Steve', score = 42, active = TRUE
   WHERE jerseyNum = 99
Non-parameterized SQL is the GoTo statement of database programming. Don't do it, and make sure your coworkers don't either.
(for P (collect 'jerseyNum '+Players 99)
   (put!> P 'name "Smith, Steve")
   (put!> P 'score 42)
   (put!> P 'active T) )