4 ms·

All queries must in the end be parameterized I would say. Both for security and performance reasons.