Yes, I became so interested in the family names that were valid SQL that the editorial was already a bit lengthy, so I didn't mention the obvious panacea of parameterizing  the query. Sorry about that!