MySQL queries constitute a signification proportion of SQL queries, and PHP's MySQL extension is responsible for a significant proportion of MySQL queries. It's

MySQL queries constitute a signification proportion of SQL queries, and PHP's MySQL extension is responsible for a significant proportion of MySQL queries. It's not a problem of MySQL and it's not even a problem of how the PHP code that uses MySQL is written - the problem is that PHP's MySQL extension doesn't even offer a way to safely prepare a statement. "Fix the developers", in this context, would mean beating them about the head until they remember to mysql_real_escape_string() every parameter every time, and that's obviously not the right approach. A better approach is to either (1) add a mysql_prepare() function to the PHP MySQL extension, or (2) deprecate the extension in favour of one which forces or at least encourages or at least supports the use of prepared statements.