Prepared statements are actually worse than escaping in Postgres because prepared statements can sometimes use the wrong query plan. Refer to the documentation:

Prepared statements are actually worse than escaping in Postgres because prepared statements can sometimes use the wrong query plan. Refer to the documentation: > In some situations, the query plan produced for a prepared statement will be inferior to the query plan that would have been chosen if the statement had been submitted and executed normally. This is because when the statement is planned and the planner attempts to determine the optimal query plan, the actual values of any parameters specified in the statement are unavailable. PostgreSQL collects statistics on the distribution of data in the table, and can use constant values in a statement to make guesses about the likely result of executing the statement. Since this data is unavailable when planning prepared statements with parameters, the chosen plan might be suboptimal. Sometimes this can be more than "suboptimal" but actually an entirely different index and orders of magnitude worse performance.