This is hilarious. SQL has had parameter binding for most of its history; SQL injection is just a recent effect of people no longer caring about parse or serialization overhead.

You can go back 20+ years and find similar rants to this; I remember going through these OODB arguments in the 90's.