On: Google results for PHP tutorials contain SQL injec...

[ipaddr]

How often are you passing dozens or hundreds of parameters to a single sql statement? Maybe there is a better way to structure things.

[sellyme → ipaddr]

How often am I doing it? Not very. But when there's a WHERE foo IN(a,b,c,...) query that has an arbitrary list as input? Could be any number of parameters in there (although I think most SQL drivers start complaining in the early quadruple digits).