You are correct. Note that what you described is not "validating the input checking for harmful SQL code". The latter is a specific case of "enumerating badness", which is a known mistake security wise. Edit: fortunately in the actual list of the errors the advice given is not to check for harmful code, but to whitelist known safe input.