Absolutely - that is the desired end state. In some languages migrating to the prepared statement API can be a considerable amount of work and that takes a lot

Absolutely - that is the desired end state. In some languages migrating to the prepared statement API can be a considerable amount of work and that takes a lot of time. If the code is mainly made up of queries with an integer ID then you can make the code safe using guards with a fraction of the effort meaning that your software is stable faster. Then you can take your time rewriting your data access layer to use the safe-by-design APIs. I should have made that clear in my original post :) BTW at some point you might need to get into escaping / validation to support operations not supported by the safe APIs. If/when you encounter this it's a massive red flag. Your system design should reflect that. It should be treated like radioactive waste: be paranoid.