Slight change of topic here. Your comment made me realize that once a system gets too complicated the only change that can be made is to add more complexity. I

Slight change of topic here. Your comment made me realize that once a system gets too complicated the only change that can be made is to add more complexity. In this case. It would be better to ensure all SQL is properly escaped, but because that isn't a trivial task, instead you end up adding another layer of complexity.