SQL injection
Using a SQL update statement like this one (spacing is optional):

UPDATE players
   SET name = 'Smith, Steve', score = 42, active = TRUE
   WHERE jerseyNum = 99
Non-parameterized SQL is the GoTo statement of database programming. Don't do it, and make sure your coworkers don't either.
UseSQLiteDatabase()
 
Procedure CheckDatabaseUpdate(database, query$)
  result = DatabaseUpdate(database, query$)
  If result = 0
    PrintN(DatabaseError())
  EndIf
 
  ProcedureReturn result
EndProcedure
 
 
If OpenConsole()
  If OpenDatabase(0, ":memory:", "", "")
    ;create players table with sample data
    CheckDatabaseUpdate(0, "CREATE table players (name, score, active, jerseyNum)")
    CheckDatabaseUpdate(0, "INSERT INTO players VALUES ('Jones, Bob',0,'N',99)")
    CheckDatabaseUpdate(0, "INSERT INTO players VALUES ('Jesten, Jim',0,'N',100)")
    CheckDatabaseUpdate(0, "INSERT INTO players VALUES ('Jello, Frank',0,'N',101)")
 
    Define name$, score, active$, jerseynum
    name$ = "Smith, Steve"  
    score = 42
    active$ ="TRUE"
    jerseynum = 99
    SetDatabaseString(0, 0, name$)
    SetDatabaseLong(0, 1, score)
    SetDatabaseString(0, 2, active$)
    SetDatabaseLong(0, 3, jerseynum)
    CheckDatabaseUpdate(0, "UPDATE players SET name = ?, score = ?, active = ? WHERE jerseyNum = ?")
 
    ;display database contents
    If DatabaseQuery(0, "Select * from players")
      While NextDatabaseRow(0)
        name$ = GetDatabaseString(0, 0)
        score = GetDatabaseLong(0, 1)
        active$ = GetDatabaseString(0, 2)
        jerseynum = GetDatabaseLong(0, 3)
        row$ = "['" + name$ + "', " + score + ", '" + active$ + "', " + jerseynum + "]"
        PrintN(row$)
      Wend
 
      FinishDatabaseQuery(0)
    EndIf
 
    CloseDatabase(0)
  Else
    PrintN("Can't open database !")
  EndIf
 
  Print(#CRLF$ + #CRLF$ + "Press ENTER to exit"): Input()
  CloseConsole()
EndIf