Of course I already use placeholders and such, but I typically only run a given SELECT statement once in this application, so it doesn't help much.

As to the fetchall recommendation, I would usually agree; but I occasionally recieve in excess of 60,000 records and do so with several instances. Resources considerations become important.