SQL injection
Using a SQL update statement like this one (spacing is optional):

UPDATE players
   SET name = 'Smith, Steve', score = 42, active = TRUE
   WHERE jerseyNum = 99
Non-parameterized SQL is the GoTo statement of database programming. Don't do it, and make sure your coworkers don't either.
module Main (main) where
 
import           Database.HDBC (IConnection, commit, run, toSql)
 
updatePlayers :: IConnection a => a -> String -> Int -> Bool -> Int -> IO Bool
updatePlayers conn name score active jerseyNum = do
    rowCount <- run conn
        "UPDATE players\
        \ SET name = ?, score = ?, active = ?\
        \ WHERE jerseyNum = ?"
        [ toSql name
        , toSql score
        , toSql active
        , toSql jerseyNum
        ]
    commit conn
    return $ rowCount == 1
 
main :: IO ()
main = undefined