a) More importantly, they enforce a discipline on you: never treat data as code. b) I'm guessing there are plenty of databases that execute parametrized querie

a) More importantly, they enforce a discipline on you: never treat data as code. b) I'm guessing there are plenty of databases that execute parametrized queries entirely differently than a plaintext ones, including the absence of an escaping step. Since the whole point of quoting + escaping is to demarcate the "data" parts of a query, and you've already done that with parameters, there's no reason a query engine can't use the parameter directly rather than run it through a useless escape then parse-and-unescape cycle.