This is very misleading. Every single place* you can write raw SQL, you can do it with a prepared statement, and then you don't have injection and the other na

This is very misleading. Every single place* you can write raw SQL, you can do it with a prepared statement, and then you don't have injection and the other nasty stuff. *At least for all the big players I have used.