Comment by JoshTriplett

It amazes me that PHP (or the database library in question) allows you to call `prepare` on a non-literal string without even a warning.