With regard to prepared statements, If you use prepared statements across the board you don't even have to bother with sanitizing user input
This is not always the case. Consider an application that presents a table, and that the application can sort on any of the columns presented. Perhaps there is a dropdown, listing all of the column names.
Column names not parameterizeable in prepared statements. Thus, you will need to do input sanitization in this case.
> Column names not parameterizeable in prepared statements.
You should still use prepared statements for these types of queries as more than likely they will have parameters as well. You might end up with a couple more SQL statements in you statement cache but that should be a non-issue and if anything be faster, not slower.
> Thus, you will need to do input sanitization in this case.
If you're dynamically sorting based on user input then you shouldn't sanitize the input, you should white list it. If you're using an RDBMS then there's a fixed, finite, set of columns the user can sort on that you can check against.
Sanitizing fields for sorting (or even querying) is more important for NoSQL databases as the interface is programmatic. MongoDB is a good (bad?) example as it interprets strings as commands so; you have to go out of your way to escape inputs even though you're programmatically using them as field names.
This is not always the case. Consider an application that presents a table, and that the application can sort on any of the columns presented. Perhaps there is a dropdown, listing all of the column names.
Column names not parameterizeable in prepared statements. Thus, you will need to do input sanitization in this case.