Yup, good thing to note, thank you!
I've kinda assumed everyone knows about the named parameters some bindings offer, but that's probably not true. Will add a disclaimer.
In the previous articles, I do talk about how this is an upgrade from plain SQL, not from regular full-blown query builders / ORMs.
This statement is about functionality / ease of use, which is fairly orthogonal from (preventing) SQL injection: with plain SQL it's perfectly possible to avoid injection attacks, in fact that's probably the most common and easiest way to do it. In that sense, if anything this is a downgrade from regular SQL.
It likely is.
Ideally, instead of dynamically building queries, one would use stored procedures.
I'm using this with SQLite, which doesn't have stored procedures, so it's an acceptable downgrade for me. Appending strings to lists gets messy quickly, example: https://death.andgravity.com/query-builder-why#preventing-co...