> You don't create statements by concatenating strings.

> Sometimes you have to concatenate, e.g. to specify order by clauses.

So, should I concatenate or not?

> This is something database vendors need to fix.

How long do you propose I wait before giving up and using a library that allows me to safely and sanely compose queries?