> I have never heard someone say parameterized queries were "useless enterprise bloat". I have. Usually from people with no idea what they're talking about, ma

> I have never heard someone say parameterized queries were "useless enterprise bloat". I have. Usually from people with no idea what they're talking about, maybe one of us has been (un)lucky in our experience. Hopefully it's me. > Their use in modern web apps is an industry best practice widely adopted across all the Internet apps Matasano gets to test. That's great! How long has it been true, though? When I first learned PHP (2003), this was not mentioned. Maybe it existed, either in MySQL directly or as an api method, but it certainly wasn't widely advertised. Maybe looking all the way back to 2003 is stepping outside the scope of "modern" here, but I still occasionally get to deal with problems created back then. > Your reaction here sounds hyperbolic, and the parent commenter is right: parameterized queries, while helpful, are neither required nor sufficient for defense against SQLI. I'm sure it does, considering the differences in our experience of the situation. Also, my point was not that parameterized queries are the end of SQLI defense or required for it. Just that you can't give MySQL as a company a pass on a situation they helped create. Parameterized queries are a very simple and common first step in learning to deal with SQL injection. Not implementing them for so long did not help the situation in this respect.