The driver isn't totally to blame, too many developers weren't and still aren't trained properly. The problem is actually that users would probably never have

The driver isn't totally to blame, too many developers weren't and still aren't trained properly. The problem is actually that users would probably never have used parameter binding even if it was available. Despite the original mysql driver not supporting parameter binding you could still mitigate against SQL injection attacks even back then. The mysql_real_escape_string() function is available to help prevent SQL injection attacks, it's been around since the dawn of PHP4 (yes I know it's not totally secure if you're not aware of your character encoding [0]) . But barely anyone used it, or even understood the purpose of mysql_real_escape_string(). I've had to trawl through ancient customer code which uses the old mysql driver on our hosting platform to explain why their site got hijacked. There's more often that not even a single use of mysql_real_escape_string(). This is code written by pro-developers I'm often told. There's not even attempts to perform naive quote escaping. The real issue is education. There are still hoards of developers who have never heard of SQL injection. Part of the problem was that the PHP documentation from back in the day provided poor examples, the other part sites like W3S omitting any mention of mitigating against SQL injection attacks. So folks merrily copy/paste never even having heard of the concept of SQL injection. I still have to educate customers about SQL injection attacks and many still stick their heads in the sand and don't want to believe this could possibly happen, or blame us. And for all of the PHP team's prognostications about binning the mysql driver, folks will just move on to mysqli or PDO and still carry on doing stuff like: $sql = "SELECT name FROM people WHERE name='$name'"; This isn't a problem specific to PHP, it's still endemic in codebases written in Classic ASP, ASP.NET, Java, python all churned out by herds of badly trained developers blissfully ignorant of the mess they're creating for their clients. [0]: http://stackoverflow.com/a/12118602/419 http://stackoverflow.com/a/12118602/419