[ameliaquining]

Parameterized statements don't actually abstract over escaping; they entirely obviate the need for it, by moving the untrusted data out of band.

[jagged-chisel]

It’s the safest interface to your database query engine no matter how it does the job. That’s what matters.