I think a blog post by Peter Bex, "Structurally fixing injection bugs", is a better description the problems associated with strings: http://www.more-magic.net/posts/structurally-fixing-injectio...

Quoting it: "In other words, you're performing string surgery on the serialized representation of a tree structure. Just stop and think how insane that really sounds!"