> I can't think of anyway that using placeholders guards against > miscellaneous code executution. > I think that the binding process automatically handles escaping single quotes, so it stops SQL injection attacks.