I just took a quick peek at the Java and Ruby tutorials you linked, and indeed they both talk about prepared statements. Unfortunately for PHP, so many of the t

I just took a quick peek at the Java and Ruby tutorials you linked, and indeed they both talk about prepared statements. Unfortunately for PHP, so many of the tutorials that are still around are very old. We have the same issues with Javascript. If one uses Google to search for a solution to a JS problem, often she or he is confronted with a solution from 1999... which is FAR from today's "best practices". Finding a 10 year old page discussing Python or Ruby connecting to MySQL is nearly impossible due to the newness in these languages in the web arena. (Yes, Zope existed way back when.) I do agree that the above example is the rule rather than the exception as most books I've owned show something similar or worse: foreach($_POST as $key => $value) { ${$key} = $value; } That's almost as convenient as that magic global form garbage they used to have turned on by default. I was under the impression though that the MySQLi adapter and PDO both made use of prepared statements. All we need to do now, is clean up the last few years of cruft/misinformation still floating around.