I have a feeling hes not using an orm system. Sketches me out considering SQL injection is still way higher up on the list of vulnerabilities than it should be.