In a past life, I converted an intranet application for some government department from Oracle&#x2F;Coldfusion.<p>The whole application, every SQL query taking input, was vulnerable to SQL injection.<p>For many insert operations, I&#x27;d find a pattern appearing of first inserting a row with some random value in one of the columns (`temp_key`), then performing a select based on this key to get the row back to know the primary key, and then continue to update other fields in the same row, and adding other records to other tables referencing this primary key.<p>Obviously, transactions was a foreign concept to the original developers. I still remember taking a deep breath once I found a code snippet that would try an insert again if the insert failed because the randomly generated `temp_key` was already used before, a problem that seemed to really start bothering them as the database grew larger...