Prepared statements only get you so far though, they're fine for parameters, but often you run into situations where you do have to build sql manually to be abl

Prepared statements only get you so far though, they're fine for parameters, but often you run into situations where you do have to build sql manually to be able to order and filter on fields dynamically. Then once part of the query is generated by string concatenation the temptation is always there to just add that one little string parameter. I've seen various mechanisms to order dynamically, but nothing as simple and readable as "if orderBy == 'foo' then sql += 'order by foo'". Dynamic filtering has a few approaches but I've seen a lot of performance issues from them. Most sql optimizers have a much better time if you concatenate the exact query you need in code. I would argue that 99% of the time such UI's arise from a failure to understand and cater to user workflows, but they still exist in the wild and I don't seem them disappearing any time soon.