Thank you. This is the answer I was looking for. I assumed (incorrectly) that the person designing the database was also involved in selecting the "prepared s

Thank you. This is the answer I was looking for. I assumed (incorrectly) that the person designing the database was also involved in selecting the "prepared statements" or "assembled queries", or was the same person. Now I'm thinking the problem may be more with the people building the interfaces to these SQL databases, and the languages they are using to build them. If that's true, then "SQL injection" seems like less of an SQL-specific problem and more of popular label for a more general "santization of user input" in internet-facing programs problem. That problem is as old as the web. And now we encourage every program to be a web-facing application, hosted in "the cloud". Yikes. Anyway, I think my original comment may indeed be valid: in 200xx, in too many cases, programmer knowledge of escaping and quoting (rules that if I'm not mistaken originated when more people were more familiar with terminals and shells) is inadequate.