Who says don't sanitize inputs? I'm just suggesting to not invent another query language, especially where a rather obvious and natural one already exists. You

Who says don't sanitize inputs? I'm just suggesting to not invent another query language, especially where a rather obvious and natural one already exists. You can and should sanitize untrusted input regardless.