Yeah, that's basically why I wrote EasyDB. https://github.com/paragonie/easydb
$rows = $db->run('SELECT * FROM comments WHERE blogpostid = ? ORDER BY created ASC', $_GET['blogpostid']);
foreach ($rows as $row) {
// etc
}
Teach people to do things this way rather than concatenate strings, say goodbye to SQL injection vulnerabilities.