By &quot;hand code SQL&quot; I hope you really mean using prepared statements of whatever language&#x2F;framework you&#x27;re using, not concatenating strings with input values. If not, say hello to SQLi.