Comment by mcv

Yeah, I think it's still useful info for an attacker. But only if the system was actually developed by amateurs who never heard of parameterized queries.

I find it a bit bizarre that the city uses "our system was developed with no consideration for security" as a valid defense.