Hacker News Reader

Am I wrong to remind that Part of the reason to not generally write raw SQL is to prevent SQL injections?

Parameterized queries do that just as well.

Yes, then your junior PRs code that doesn't use it and it gets missed in the scuffle