&gt;&gt; You might be interested to know your example doesn&#x27;t escape that correctly.<p>It does -- You&#x27;re right that the double-quote escaping is part of the original SQL standard, while the c-style escaping is an extension to it. However so is a lot of behaviour in modern SQL databases and it doesn&#x27;t make my example incorrect.<p>Off the top of my head, here is an incomplete list of databases that implement c-style string escaping: Mysql, Postgres, Vertica, BigQuery, Oracle 9.2<p>&gt;&gt; some databases implement prepared statements as simple query string interpolation -- Do you have one in mind?<p>Yes, immediately both mongodb and bigquery come to my mind which are both pretty popular and do not currently support server-side prepared statements. If you google for jdbc drivers for theses databases some will implement &#x27;prepared queries&#x27; as string interpolation on the client side.<p>Random Example: <a href="https:&#x2F;&#x2F;github.com&#x2F;jonathanswenson&#x2F;starschema-bigquery-jdbc&#x2F;blob&#x2F;master&#x2F;src&#x2F;main&#x2F;java&#x2F;net&#x2F;starschema&#x2F;clouddb&#x2F;jdbc&#x2F;BQPreparedStatement.java#L175" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;jonathanswenson&#x2F;starschema-bigquery-jdbc&#x2F;...</a><p>&gt;&gt; how exactly are prepared statements worse?<p>That&#x27;s not what I said. My point (and I think we agree here) was that using a correct interpolation routine is just as secure as using a prepared statement with regards to SQL injection vectors.