I once worked on a system where the original developer, supposedly with 25+ years experience, did not know about prepared statements. He had developed his own h

I once worked on a system where the original developer, supposedly with 25+ years experience, did not know about prepared statements. He had developed his own home grown "ORM" that attempted to manually escape SQL. You can guess how well that worked out. We'd get SQL 'syntax errors' in production regularly.