Zaxo, I've never actually thought of using the placeholder technique. I've read up on some interesting use, thanks for the info very helpful.

Also, I use mod_security and check/strip the input of any bad characters with a regex. If a user where to enter a SQL query of some sort, mod_security logs the attempt and throws an error. I think maybe the placeholder would add another layer of security...?