You're right, of course, that you should never use user-input data as code. SQL bind parameters solve this problem for SQL. I'm sure there exist other things

You're right, of course, that you should never use user-input data as code. SQL bind parameters solve this problem for SQL. I'm sure there exist other things without such an easy solution, in which case you do need to sanitize with a whitelist.