Ahhhh.....you know what, now that I think about it, I remember last semester for a class I had to do a bunch of PHP + SQL for a Backend (my first time really using either). I basically just googled a bunch of stuff and I ended up just writing the queries in as strings basically because that's what I saw on a site (very possibly one of the ones in question).

I felt it was wrong because I was concerned about SQL injection, but my professor really didn't care about security so I wasn't too too concerned. Later on my professor mentioned that pre-compiled statements (I think that's what they are called) and I facepalmed because that would have been way more secure and been 5x easier anyways.

So yea, I guess they still are giving bad advice.