ActiveRecord uses actual, PostgreSQL prepared statements in many cases. Eg if you execute `User.where(email: "[email protected]")`, it will prepare, bind and execute the query separately, with "[email protected]" being sent to PG as a bound parameter. You can see this if you flip the proper flags in the PG config and tail its log.

In other cases, like `User.where("email like ?", "#{params[:email_like])}%")`, AR will escape the provided value itself and no bind parameter will be used. However, it will still use a prepared statement, which at least means that only one database query will execute; no matter what AR does or fails to do with it's escaping, you won't execute both the `SELECT` and a `DROP TABLE` because a prepared statement can only be one statement.