Ah, come on. The only concrete charge you bring forth here is to the practise of using string concatenation for sql parameters. Since v. 5.1 (Which is somethin

Ah, come on. The only concrete charge you bring forth here is to the practise of using string concatenation for sql parameters. Since v. 5.1 (Which is something like 5 years old .. in Internetyears, that's one century), PDO has been the default db-access layer, and it supports bound parameters. Oh, and I've seen plenty of unescaped string concatenation in Rails apps too. It's a developer issue - not a language issue.