Sql-injection functions and techniques for escaping(take 3):
1. When variables within limits
2. When variable for the sort order
3. When variable for an identifier
(all of these are things that are exceptions to standard binding/escaping)