Nah, it will end up simply as "John" in the database. You need "John%sDoe" to crash C software with unsafe printf() calls, and even then it's better to use several "%s"