NOTE: 这篇文章迁移自旧博客(typecho)

We should never be doing string interpolation to construct queries from user-supplied values.