I think this is an unfair comparison. Constructing SQL query strings is risky, because it is essentially dynamically constructing and evaluating code from user

I think this is an unfair comparison. Constructing SQL query strings is risky, because it is essentially dynamically constructing and evaluating code from user input. However, there is no reason why one can't use parameters (like you mention) or even call stored procedures.