I think the point he was trying to make, was that using prepared statements with PDO or mysqli would prevent this