Sorry, I actually intended to reply to the parent of your comment -- reposted and deleted my response just after you commented. Parameterized queries aren't a

Sorry, I actually intended to reply to the parent of your comment -- reposted and deleted my response just after you commented. Parameterized queries aren't a panacea, but they seem to mitigate most of the issues. That said, a lot of people rely solely on them, thinking they really are. While certain things make the vast majority of attacks infeasible (e.g. using SQLAlchemy rather than any straight SQL), nothing can replace actually knowing about the security issues and designing solutions that are immune to them.