> As for SQL injection, were prepared statements even a thing back then? wow. yes, prepared statements have been a thing since there were relational databases

> As for SQL injection, were prepared statements even a thing back then? wow. yes, prepared statements have been a thing since there were relational databases. but also, (server side) prepared statements are not required in order to use SQL with bound parameters. the binding can occur just as easily on the client side, and this is in fact quite common. the point is that the programmer is not manually deciding whether or not to escape a parameter on a query-by-query basis, the process is automated.