2 ms·

Because it escaped input too early (and did not fully escape), not because auto escaping sql is a bad idea.