It's a way to mitigate sql injection attacks when you don't want to pay for a rewrite of the data layer to not communicate with the database by blindly mashing

It's a way to mitigate sql injection attacks when you don't want to pay for a rewrite of the data layer to not communicate with the database by blindly mashing strings together. And don't get me started if your name can't be written in US-ASCII, i.e. if it has weird squiggles above or below the characters or if it's written in gasp cyrillic.