Good point. I was in the middle of doing a bunch of string formatting when I replied. Concat is definitely the better choice.

Squash the dangers lurking in your SQL queries by setting parameters by way of parameterized queries.