Almost every single native RDBMS API provides parameterized queries / prepared statements where the parameters are sent separately from the query text. Here's one from MySQL:
String escapes should have been dead a few decades ago -- I don't think any modern platform requires it; they all support parameterized queries natively.
https://dev.mysql.com/doc/refman/5.7/en/mysql-stmt-bind-para...
String escapes should have been dead a few decades ago -- I don't think any modern platform requires it; they all support parameterized queries natively.