sql injection is commonly caused by combining your query with its related data parameters in unsafe ways. you are emitting raw user input you received to anothe

sql injection is commonly caused by combining your query with its related data parameters in unsafe ways. you are emitting raw user input you received to another program, the database, it's your responsibility to give this to the DB safely. you still have to be careful, and when you follow all the right best practices you can safely ingest raw user input. I've worked at a company that escaped user input before inserting into the DB. it's a horrible nightmare I don't think anyone should have to experience.