Scroll down to Mitigation : Use bound parameters (the PREPARE statement) , where the example in Perl uses placeholders in a prepare statment, like this:

$sth = $dbh->prepare("SELECT email FROM members WHERE user_id = ?;");
$sth->execute($user_id_from_form);
[download]

...at no point do the contents of this variable have anything to do with SQL statement parsing. Quotes, semicolons, backslashes, SQL comment notation - none of this has any impact, because it's "just data". There simply is nothing to subvert, so the application is be largely immune to SQL injection attacks.

...enormous security benefits. This is probably the single most important step one can take to secure a web application.

If so, I'm thinking this should just be standard practice for any and all DB transactions that pass user input to an sql statement.

So the question to this post is whether the Monastery agrees with the assertions of ths website.