I just read one of the comments below and thought: we should write sql as an AST and not as a string. That solves many problems, not only SQL injection but also

I just read one of the comments below and thought: we should write sql as an AST and not as a string. That solves many problems, not only SQL injection but also the lousy understanding of joins etc.