There is much to exploit if the driver itself is buggy. Theoretically it's possible that between various 8bit/16bit encodings, locales, collations, client/serv

There is much to exploit if the driver itself is buggy. Theoretically it's possible that between various 8bit/16bit encodings, locales, collations, client/server configuration mismatches somebody could find a creative way to smuggle some unescaped quotemark. Binary protocol which parses SQL commands client-side and treats strings as blobs of bytes removes any chance of SQL injection for good.