SQL injection
Using a SQL update statement like this one (spacing is optional):

UPDATE players
   SET name = 'Smith, Steve', score = 42, active = TRUE
   WHERE jerseyNum = 99
Non-parameterized SQL is the GoTo statement of database programming. Don't do it, and make sure your coworkers don't either.
import Database as db;
import Algorithms as algo;
import FileSystem as fs;
 
main() {
  dbPath = "/tmp/parametrized-sql.sqlite";
  fs.remove( dbPath );
  fs.open( dbPath, fs.OPEN_MODE.WRITE );
  conn = db.connect( "sqlite3:///" + dbPath );
 
  // Setup...
  conn.query(
    "CREATE TABLE Players (\n"
    "\tname VARCHAR(64),\n"
    "\tscore FLOAT,\n"
    "\tactive INTEGER,\n"
    "\tno VARCHAR(8)\n"
    ");"
  ).execute();
  conn.query(
    "INSERT INTO Players VALUES ( 'name', 0, 'false', 99 );"
  ).execute();
  conn.query(
    "INSERT INTO Players VALUES ( 'name', 0, 'false', 100 );"
  ).execute();
 
  // Demonstrate parameterized SQL...
  parametrizedQuery = conn.query(
     "UPDATE Players SET name=?, score=?, active=? WHERE no=?"
  );
  for ( i, v : algo.enumerate( ( "Smith, Steve", 42, true, 99 ) ) ) {
    parametrizedQuery.bind( i + 1, string( v ) );
  }
  parametrizedQuery.execute();
 
  // and show the results...
  for ( record : conn.query( "SELECT * FROM Players;" ).execute() ) {
    print( "{}\n".format( record ) );
  }
  return ( 0 );
}