> the only way to get people to write good code is not to educate them on the right way, but to make the right way the default / easy / lazy way. Completely ag

> the only way to get people to write good code is not to educate them on the right way, but to make the right way the default / easy / lazy way. Completely agreed. Binding each parameter manually, or even writing a simple prepare/execute pair, is probably too much hassle for somebody who is used to the utter simplicity of a mysql_query() function call. Which is why, in one of my own home-baked libraries, I hide all of the prepare/bind/execute complexity behind a single method call: $rows = DB::query('SELECT * FROM table WHERE col1 = ? AND col2 > ?', $param1, $param2); Behind the scenes, it's PDO with prepared statements. On the surface, it's just as simple as mysql_query(), except you don't even have to worry about string interpolation. You can also pass the parameters as an array if you want to. I'm not saying that this is the best way to do it, but if the way you're planning to do it is anything that looks remotely similar (prepared statements and bound parameters behind the scenes), then you have my apologies for having been too cynical without seeing the actual code. On the other hand, if it's just a sanitizer based on a blacklist of special characters, I would persist in my criticisms.