The first query bound its parameter and stored the value correctly. Nothing about that request was wrong. A later request reads the value back and puts it into a statement by concatenation, and the whole defect is that nobody looked twice at a value that had come out of their own database.
It is worth being precise about why that reasoning is wrong. A database is not a source of trust; it is a place values were put. Whatever went in is what comes out, and what went in came from a request.
POST /profileStored, and nothing happens. This request is fine — it binds its parameter.
GET /me/namesakesA different request, carrying nothing. Watch the statement the store parsed.