As a PHP developer, I've definitely seen a massive decrease in the number of people who are just passing queried values directly into the construction of their SQL string as people have started emphasizing using prepared statements.
But this has done nothing towards stopping people from passing column/table selections directly into those strings. It seems as though everyone is using prepared statements now because they were told to not because of any kind of understanding of why.
Comments
As a PHP developer, I've definitely seen a massive decrease in the number of people who are just passing queried values directly into the construction of their SQL string as people have started emphasizing using prepared statements.
But this has done nothing towards stopping people from passing column/table selections directly into those strings. It seems as though everyone is using prepared statements now because they were told to not because of any kind of understanding of why.