> The "write-raw-SQL-with-raw-strings" approach has one serious issue -- sql-injections.

Nobody has advocated writing "raw SQL with raw strings" in years.

The valid way of using Raw SQL is using prepared statements and parametrized queries.

This method will protect you from SQL injection, will handle most issues with type/conversions and the queries are cacheable, so it's fast too.

Parametrization is handled by the database itself (not the specific driver), so it is battle tested.

https://stackoverflow.com/questions/8263371/how-can-prepared...