Discussion on question by Dennis: Why did SQL Injection prevention mechanism evolve into the direction of using Parameterized Queries?

Prepared statements / parameterized queries existed as a performance measure. They just happen to be immune to SQL injection attacks. In the early days of web programming, books contained nice simple examples of how to write SQL queries. For the sake of simplicity in presentation, they demonstrated the literal string approach. Unfortunately, such examples formed the basis of a lot of production code. Only as web programming newbies worked their way up the learning curve did they realize the vulnerability of their code to SQL injection.