I think this comment sums it up nicely: http://blog.ianbicking.org/php-ghetto-comment-11.html http://blog.ianbicking.org/php-ghetto-comment-11.html It basicall

I think this comment sums it up nicely: http://blog.ianbicking.org/php-ghetto-comment-11.html http://blog.ianbicking.org/php-ghetto-comment-11.html It basically argues that in PHP there's often an easy, insecure way to do something and a verbose, secure way to do it. With regards to SQL injection, Java is the same way; prepared statements are much more verbose and annoying than string concatenation.