title: Reasons for Prepared Statements with Bind Parameters over Interpolated Statements with Escaped / Quoted Parameters
body: <p>To protect against SQL injection one is advised to use <em>prepared statements</em> with <em>bind values</em>. This ensures, that the database can distinguish between the actual logic in the SQL (which has to be parsed, interpreted and optimized) and the data (which doesn't need interpretation) and therefore will not interpret and execute commands which are found in data.</p>
  
  <p>Another method accomplishing some protection is using an <em>escaping library</em>, which disarms significant chars in the data, so that they will not be interpreted.</p>
  
  <p>It seems to me that in general it is advised to prefer <em>prepared statements</em> with <em>bind parameters</em> over <em>escaping</em> the input. <em>Prepared statements</em> with <em>bind values</em> do for example have some performance benefits in loops.</p>
  
  <p><strong>My question:</strong> is there any security reason to prefer <em>prepared statements</em> with <em>bind values</em> over <em>escaping</em>? And if yes, what are the exact reasons?</p>
  
  <p>One reason I might think of is that "escaping is tricky" and the escaping library needs to match exactly the database features... anything else?</p>