&gt; (&#x27;Gijs in \&#x27;t Veld&#x27;)<p>You might be interested to know your example doesn&#x27;t escape that correctly.  SQL syntax escapes quotes by doubling them:<p><pre><code>        (&#x27;Gijs in &#x27;&#x27;t Veld&#x27;)
</code></pre>
Correctness is not as easy as falling out of bed.<p>&gt; Prepared statements have nothing to do with this and are _in no way_ more resilient to SQL injection vulnerabilities than correctly interpolated non-prepared SQL queries.<p>Actually, that&#x27;s <i>why</i> prepared statements have everything to do with it: correct escaping is error prone.  The simple advantage of prepared statements is that the parameters are handled as <i>data</i>, not as syntax.  There&#x27;s nothing to invent, and nothing to go wrong.<p>&gt; some databases implement prepared statements as simple query string interpolation<p>Do you have one in mind?  I can name 10 that don&#x27;t, all names you&#x27;d recognize.<p>Besides, you&#x27;ve hoisted yourself on your own petard.  If, ad arguendum, correct interpolation is _in no way_ more vulnerable than prepared statements, and prepared statements are <i>correct</i> interpolation, how exactly are prepared statements worse?