PHP was one of my first languages. A common mistake I saw a lot of devs make was using string interpolation for SQL statements, opening the code up to SQL injection attacks. This was fixable by using prepared statements.

I feel like with LLMs, the problem is that it's _all_ string interpolation. I don't know if an analog to prepared statements is even something that's possible -- seems that you would need a level of determinism that's completely at odds with how LLMs work.