Sequel's right way:
user = db['SELECT name FROM users WHERE id = ?', id].first
user = db["SELECT name FROM users WHERE id = #{id}"].first
$stmt = $db->prepare('SELECT name FROM users WHERE id = ?');
$stmt->execute([$id]);
$user = $stmt->fecth();
$user = $db->query("SELECT name FROM users WHERE id = $id")->fetch();
> Just like any other template language (thinking of something like ColdFusion or ASP), of course one unescaped variable is going to be a headache.
That is simply not true. Look at Twig which by default escapes everything automatically, or Rails's patched ERB which keeps track of escaped an unescaped strings based on data types and makes sure everything is automatically escaped in the end. In those template languages you need the explicitly do something unsafe to get an unescaped value. While in PHP you need to audit all places where echo can be called directly or indirectly.
$user = $db->find('user', 'first_name = ?', ['Name']);
PDO isn't "optimized" to do them the wrong way or the right way. Yes, it's less code to do it the wrong way, but that isn't a true definition of easier.
As for the escaping, I would expect Twig to escape things, it's want it's meant for (and the reason you use it instead of just vanilla PHP). And Rails is a subset of Ruby correct? So not a true comparison again.
Just like any other template language (thinking of something like ColdFusion or ASP), of course one unescaped variable is going to be a headache. But you don't have to use it that way, and probably shouldn't. While PHP started as a template language, it has clearly moved past that.