Why the last chip works: q is formatted into the SQL string with no parameter binding, so a quote ends the literal and the rest runs as query logic. Errors from a broken payload come back as a 500 with the trace, like /boom.