One of the ignorances has to do with unfamiliarity with set programming plus premature optimization. Many production SQL code I've seen use concatenations to generate dynamic sql statements for creating different where clauses and return different columns, which of course leads to SQL injection problems (as well as difficult to debug SQL query/stored procedures).  Often the developers in charge (even experienced ones) don't know how to write one single sql statement to represent the "different" sql statements (even if they know how to do so they rather use dynamic SQL to write more compact thus "optimized" statements).  The same developer often is more comfortable write cursors and loops rather than using selects appropriately. <div>On 5/31/07, Danny Yoo <<a href="mailto:dyoo@cs.wpi.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">dyoo@cs.wpi.edu</a> > wrote:<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> I think it's ignorance. When I was doing Python programming, I saw newcomers work with the Python DBI and almost always not use prepared statements but rather string concatenate.  That's what their teacher told them to do.  And even people who should know better can propagate this problem.  Here's one example:      <a href="http://mail.python.org/pipermail/tutor/2003-April/022010.html" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> http://mail.python.org/pipermail/tutor/2003-April/022010.html </a> I saw the same thing with many Java programmers: I rarely saw use of prepareStatement(), and even when I saw people using it, the code would completely miss the point of prepareStatement(); I'd see code like:      stmt = conn.prepareStatement("insert into article (title) values ('" +                                   title + "')");      stmt.executeQuery(); which made me laugh and cry at the same time. I'm very glad that Hans's SQLID interface includes support for prepared statements.  I would like to see it highlighted more vividly in the documentation.  As it is, it's just a quick mention in: <a href="http://www.elemental-programming.org/sqli.html#_code__sqli_query_sqli_handle_query___args____boolean__code_" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://www.elemental-programming.org/sqli.html#_code__sqli_query_sqli_handle_query___args____boolean__code_ </a> as a set of optional arguments passed to the "query" method. _________________________________________________   For list-related administrative tasks:   <a href="http://list.cs.brown.edu/mailman/listinfo/plt-scheme" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)"> http://list.cs.brown.edu/mailman/listinfo/plt-scheme</a> </blockquote></div>