You have not formatted the code in a way that makes it conveniently readable for me. Please use <code>...</code> around your data and code so it displays and downloads nicely.

As I said already, you are interpolating data directly into your SQL. You don't want to do that. So, use placeholders instead, like Anonymous Monk already suggested and I already suggested as well.