You're being overly pedantic. It would be equally pedantic to say the Bobby Tables xkcd comic is "wrong" because an SQL injection ought to start with table enumeration rather than hard coding the 'Students' table name.