addUnsafe

Adds a SQL fragment to the statement being built, WITHOUT rewriting string interpolation into bind parameters.

Any value interpolated into sql is embedded in the SQL text as-is, so passing user-controlled input directly can lead to SQL injection. To include dynamic values safely, bind them with bind:

addUnsafe("user_id = ${bind(userId)}")