Yeah, that's what I was assuming with regard to quoted strings. The problem wouldn't be so bad with outside quotes, but once you get into having to check whether the value was actually escape quoted ('O\'Donnel' for example) and so on... Ugh.

I suppose I can just go ahead and push the bound parameter values into an array to execute. That seemed like a clunky way to do it in my head, because it just seemed too possible to miscount or trip up... but maybe that's not as likely as I first thought.

Not to mention... quote()'ing everything is insane and I've been avoiding it as much as I can except in this specific circumstance.

Sometimes you have the answer all along and just need people to reaffirm that you're not stupid. :) Thanks.