possibly leave yourself open to SQL injection attacks. While you may be the only one using your script, it's likely that you're using values you're getting from a database, file, or some other external source. So I finally got around to writing a function that supports parameterised queries, and thought I'd offer it up in case others find it useful.