You may find that if you have taint checking turned on and your where clause is built from a param passed into your script, that you must untaint the value first.