title: How does sprintf() protect against SQL injection?
body: <p>I have heard that <code>sprintf()</code> protects against SQL injection. Is it true? If so, how?</p>
  
  <p>Why people are recommending to write query like this:</p>
  
  <pre><code>$sql = sprintf('SELECT * FROM TABLE WHERE COL1 = %s AND COL2 = %s',$col1,$col2);
  </code></pre>