Yikes. I'm working on an internal web app which can only be accessed on our network and even I am using parametrized queries to prevent injection.

What a joke, and then blaming the documentation...just wow.