"because PHP" is absolutely not the answer. I haven't touched PHP since 5.5, but even since then, PHP had a very solid SQL interface (mysqli and most importantl

"because PHP" is absolutely not the answer. I haven't touched PHP since 5.5, but even since then, PHP had a very solid SQL interface (mysqli and most importantly, PDO), which offer a very beautiful and fully functional interface to parametrized queries à la JDBC. And even then, the PHP documentation was ALWAYS telling people "PLEASE FOR THE LOVE OF EVERYTHING THAT IS HOLY MOVE TO PDO AND STOP USING NON-PARAMETRISED APIs" But the problem is that with PHP, a LOT of the problems are usually resolved by programmers using the age old "copy pasta from a stackoverflow thread that's 10 years old". However, I do concede that for someone who's in a security context, it is absolutely narrow minded to allow ANYTHING beyond parametrized queries.