By "hand code SQL" I hope you really mean using prepared statements of whatever language/framework you're using, not concatenating strings with input values. If not, say hello to SQLi.