I'd rather have SQL API taking not strings but a special type that string can't be directly converted into without escaping (by default).
In C++ tagged literals could be used to create this special type easily. Similar constructs exist in some other languages