They’re a programmer, do you expect them to know anything about security? Those are the people that “SELECT %s FROM foo”