Hacker News Reader

Keeping passwords in plain text has nothing to do with not using prepared statements. There may be a correlation between the two types of stupidity, though.

This is not relevant to SQLite, but depending on your table structure, the constraints, your data, your query and the phase of the moon, some database systems (Oracle and PostgreSQL come to mind) can generate much better query plans if all the values are available when the query is planned. I still wouldn't recommend anyone to concatenate the (escaped) query parameters right into the query text unless they really know what you're doing.

This problem seems to be fixed in recent versions of Oracle:

https://blogs.oracle.com/optimizer/entry/explain_adaptive_cu...

Report them to http://plaintextoffenders.com/ ;)