Absolutely, yes. Someone has to write the parameterization libraries. That is, whatever abstraction layer you want to employ, in the end SQL queries are strings.

And the passing reference to the potential misuse here can be a big bold statement at the top of your answer.