Is SQLi vuln in the code below? If the code doesn’t %s, that code can execute SQLi, but I don’t know if the below code is safe or not