This changes my perspective on SQL. It is not enough for a programmer to know "enough SQL to get by". He must know every feature and syntactic quirk of his targ

This changes my perspective on SQL. It is not enough for a programmer to know "enough SQL to get by". He must know every feature and syntactic quirk of his targeted engine to write secure code and paste up queries. Here we see an obscure vendor specific function that almost no one would ever seek out leading to a security failure. Personally, I never paste up queries anymore. I always use parameter substitution. It leads to some awkward but idiomatic constructs when dynamically constructing a predicate, but I sleep better.