Indeed, you should always use parametrized SQL statements. This ensures that injections are impossible. Don't bother with manually escaping parameters, as you a

Indeed, you should always use parametrized SQL statements. This ensures that injections are impossible. Don't bother with manually escaping parameters, as you are bound to forget one case. The NoSQL databases I've worked with always use the parametrized format (no text-based query format at all), so injection wasn't a problem.