And no, I'm not being snarky. I wish I was.
Coming from Google, top answer to inserting data with python+psycopg2: https://stackoverflow.com/questions/61861310/how-to-use-psyc... (no bound variables, straight up format string)
Same route, this time asking about allowing requests between subdomains: https://stackoverflow.com/questions/11161526/cross-subdomain... (question specifies they "already use CORS: <star>" and nobody even comments on that)
And let's not forget, PHP is still a thing: https://stackoverflow.com/questions/43497587/how-to-display-... (yep, user supplied input goes straight to SQL query string)
---
All of the above were results of about 10 seconds of searching. Each one came from the first page of Google results - because let's be honest, that's what almost everyone cares about.
To be fair, at least these days I can't find the "just use CORS=<star>" answers. They were bountiful two years ago, but maybe, just maybe, have been flagged as cataclysmically insecure since then.
(EDIT: remove asterisks in CORS gripes)