This is false. Of course you can use any special characters in a literal string without using prepared statements. You just have to escape them correctly.<p>Example:<p><pre><code>     INSERT INTO USERS (name) VALUES (&#x27;Gijs in \&#x27;t Veld&#x27;);
</code></pre>
Inserts the following row into the database<p><pre><code>     ... | name             | ...
     ========================
     ... | Gijs in &#x27;t Veld  | ...

</code></pre>
Prepared statements have nothing to do with this and are _in no way_ more resilient to SQL injection vulnerabilities than correctly interpolated non-prepared SQL queries.<p>(In fact, some databases implement prepared statements as simple query string interpolation in the client&#x2F;driver. So this might be exactly what&#x27;s happening when you use &#x27;prepared statements&#x27; depending on the db)