[sanderjd]

This resonates with me.

But the other super critical thing (which was the first part of my original comment, and which nobody has really highlighted here) is a mature query construction library that knows how to properly protect against injection.

[ris]

In all fairness a properly used sql connector library will hopefully do this too.