"Today’s web apps are generally written with frameworks like Ruby on Rails, Django and the like, all of which include things like sanitized database queries and

"Today’s web apps are generally written with frameworks like Ruby on Rails, Django and the like, all of which include things like sanitized database queries and more. So bother with prepared statements or other expensive (performance-wise) database server tools?" Is it too much to ask that bloggers know what they are talking about? Prepared statements are not expensive performance wise. In fact they usually result in a slight increase in speed because they factor out the time required to parse and plan the query and even if some performance is lost thorugh suboptimal planning (rare), the gains in security are well worth it. For some reason, bloggers post excellent and insightful posts about everything CS until they hit databases where their common sense goes on vacation.