2
The method query() only accepts SELECT queries unless the request method is "post", as it normally is for form submittals.
This is a security feature.
You can use method queryF() in place of query() to do non-SELECT queries from a "get" request, but that should only be done if it's not practical to use a form. If you do this, it's especially important that you do your own security checks, such as sanitizing user input.