I realize this is just for prototyping but it looks like it just spits sprintf SQL strings into the database. While not a security risk if done locally, why no

I realize this is just for prototyping but it looks like it just spits sprintf SQL strings into the database. While not a security risk if done locally, why not just use a where string builder to generate the $ values and a variadic as the input? It's about the same amount of work.