I never said it was a problem with the language. I said it was poorly supported in a lot of platforms including PHP and I stand by that. It has nothing to do w

I never said it was a problem with the language. I said it was poorly supported in a lot of platforms including PHP and I stand by that. It has nothing to do with passing security audits or withstanding attacks, there's not a security flauw in the way PHP handles this because PHP or specifically the PDO framework relies on the user to implement this themself. There obviously can't be a security flaw in something which does not exist. A quick Google search suggests it is not at all obvious to many how to do a parametrised query with an IN-clause using PDO. The highest ranking answer is this SO post: http://stackoverflow.com/a/1586650 http://stackoverflow.com/a/1586650 Having to iterate the array yourself adding the right amount of placeholders and binding individual values is secure but a lot of boilerplate. Escaping values in PHP and concatting them in the old fashioned way ought to be safe but everyone switched to parametrised queries for a reason: in practice it's often fucked up which leads to security vulnerabilities. The last one, the find_in_set trick, is a clever kludge but a kludge nonetheless. People shouldn't need to roll their own way to do this because that's where unnecessary mistakes get made.