100% agreed, I have the same sentiment. In the year 2015, everyone should know about injections and how to use prepared statements and similar insertion mechanisms that clearly separate query from data. A big no-no to solve anything with the presented function.