In coding femtoblogger I wanted a simple way to avoid SQL injection attacks. I think I've settled on one simple rule:

"Never paste any variable into a query string."

That is much simpler than the "never paste user input into a query string" or the "always call the proper escape function for variables" methodology. I use the '?' and bind all variables.

Somethings come out in two lines (prepare,execute) instead of one (query), but overall I think the code is more legible without having to read through the concatenation, string delimiting, and escape functions.