[anyonecancode]

PHP was one of my first languages. A common mistake I saw a lot of devs make was using string interpolation for SQL statements, opening the code up to SQL injection attacks. This was fixable by using prepared statements.

I feel like with LLMs, the problem is that it's _all_ string interpolation. I don't know if an analog to prepared statements is even something that's possible -- seems that you would need a level of determinism that's completely at odds with how LLMs work.

[simonw]

Yeah, that's exactly the problem: everything is string interpolation, and no-one has figured out if it's even possible to do the equivalent to prepared statements or escaped strings.