Checked over latest changes for potential SQL injection, all variable usages are either (from trusted sourced AND case) or using parameters/bindings to ensure it's handled at driver/lib level.