Comment by dmilicevic

it mitigates quite some SQL injection possibilities, but yes, string concat while building queries still remains an issue.