There are APIs around SQL that are pretty good in avoiding SQL injections; for example SQLAlchemy (a Python ORM) allows you watch pretty much any SQL query with

There are APIs around SQL that are pretty good in avoiding SQL injections; for example SQLAlchemy (a Python ORM) allows you watch pretty much any SQL query without writing literal SQL. You can use raw/literal SQL, but it's buried pretty deep in the docs. Having a textual representation (with placeholders, of course) has some advantages I wouldn't want to give up: * learn once, use it everywhere * it's independent of the host language * it's a reification of a query or an action, which is very useful for logs (like slow query log), debugging and the likes