What changed
User-controlled values that were interpolated directly into SQL strings are now passed as bound parameters. The query text becomes a constant; the data travels through the driver's parameter channel, so it can never be parsed as SQL.
− string concatenation
+ bound parameters ($1, $2, …)
2 files