Wait, I was talking about a vulnerability called "sql injection", it's a way to introduce malicious sql code in a human filled form.

If you have a field that is concatenated in a sql query, some like:

query = "SELECT * FROM USERS WHERE SP > " + sp;

If I put this in the field:
[1 select password from users --]

I can execute sql code in your app. Even if you use a read/write connection, the code could contain some "drop table " or "drop database". Take a look of this: