The poor PHP tag is still suffering from a lot of questions caused by the most basic syntax issues.

One of such questions is constructing an SQL query dynamically, when the OP simply forgetting/having no idea at all about SQL syntax rules for strings, making their query like

```
SELECT * FROM t WHERE name = $name

```

*habitually*, these questions are tend to be closed with a suggestion to add quotes around a variable name.

The problem is, such a suggestion is promoting the most notorious vulnerability, making this code straight open to [SQL injection](https://xkcd.com/327/).

So, in my opinion, the closure should be different, one which explains how to use prepared statements. However, there is a strong if not fierce opposition to such a closure. Their argument, as far as I can make it, "prepared statements are too complex a feature to grasp for a noob, so it cannot make an answer."

So the question is, should we avoid complex but secure suggestions in favor of insecure but easy to understand ones?