> and has been defended by some as an "useful" feature. I would say the feature is useful but the implementation is insane. I would expect a SQL prepared stat

> and has been defended by some as an "useful" feature. I would say the feature is useful but the implementation is insane. I would expect a SQL prepared statement approach, only contents of the statement / format string are resolved. Interpreting variables in user provided input just asks for SQL injection attacks and needs to be either prohibited or extremely restricted.