That last example is poorly chosen on other levels as well: - Because the values are concatenated into the query it makes the query harder to cache for the dat

That last example is poorly chosen on other levels as well: - Because the values are concatenated into the query it makes the query harder to cache for the database. For performance reasons queries should always be prepared / parametrized. On Oracle this makes such a big difference that at a big customer of my employer a single query by a different app in its own schema (ran lots of times) was the bottleneck causing five-fold decreases in responsiveness in our app on our schema. - There's no escaping at all, this is like an open door for hackers. Again, with parametrized queries there would have been less risk (you can still get SQL injection in triggers, but the risk is definitely lower).