SQL Servers have an API for a client language, and often they are extremely cumbersome for prepared statements.  Not to mention that in many cases this &quot;language&quot; has no coherent way to say the obvious operation of &quot;Escape all the control characters in this string&quot;.<p>If you don&#x27;t offer that, your language sucks.