&gt; I wonder how everyone in the original thread comments is still falling for this infamous &quot;sanitize input!&quot; trap.<p>I don&#x27;t know, but what I do know is that plenty of people <i>still</i> don&#x27;t
understand how to use SQL APIs for their languages. Perl&#x27;s DBI has variable
placeholders (similar to %x sequences in printf()) for dozen years already.
Python&#x27;s DB-API 2.0 (PEP 249) has placeholders, too. Heck, even PHP has those.
And placeholders make any input sanitization unnecessary, because it&#x27;s
the library that does the escaping part of constructing a query. And this way
is more convenient, too, as string concatenation rarely results in pretty
code.