it's more a problem with the APIs for talking to the vendor's DB. the easiest way to add user input to a DB query should be the right one. minimally, a DB query should not be trivially the same type as user input.