I think it's very natural that code in questions is vulnerable to SQL injections as it should be a stripped down example demonstrating the issue that the poster is dealing with, not necessarily a copy-paste of code that's in production.
I created a fork of AnyBar with added support for specifying an icon id for any icon from icons8.com and the status icon will change to it. https://github.com/niklasberglund/AnyBar-icons
Just now quickly whipped it together. Needs improvement(error handling and asynchronous downloading) and packages.