Most SQL systems have bind parameters for this sort of thing. That is a form of encoding the input. You have to encode the SQL values as well. You're basically saying if you don't use the suggested technique, the suggested technique doesn't work. Well, yeah. It has to be used consistently, all the time, every time.
Unfortunately, that's just life. There's no way around it. One way or another you're going to be doing something or you're going to get owned.
Unfortunately, that's just life. There's no way around it. One way or another you're going to be doing something or you're going to get owned.