I always check/limit/cleanup the user variables I use in database queries

Like so:

```
$pageid = preg_replace('/[^a-z0-9_]+/i', '', $urlpagequery); // urlpagequery comes from a GET var

$sql = 'SELECT something FROM sometable WHERE pageid = "'.$pageid.'" LIMIT 1';

$stmt = $conn->query($sql);

if ($stmt && $stmt->num_rows > 0) {

    $row = $stmt->fetch_assoc();

    // do something with the database content

}

```

I don't see how using prepared statements or further escaping improves anything in that scenario? Injection seems impossible here, no?

I have tried messing with prepared statements.. and I kind of see the point, even though it takes much more time and thinking (sssiissisis etc.) to code even just half-simple queries. 

But as I always cleanup the user input before DB interaction, it seems unnecessary

Can you enlighten me?