That's seemingly a PERL/PHP (or whatever language that is) problem, or perhaps the wrapper being used, but not an SQLite problem. In SQLite, using the C API, that "Parameter setting" would be bound using specialized API functions, such as "sqlite3_bind_text()" or "sqlite3_bind_int64()" etc. which cannot and will not be misconstrued. I'm assuming PHP would try to determine the type of the parameter and then decide which bind-function to use, and in there it (PHP) actually misinterprets the value to be Integer and also parses it as an expression. SQLite wouldn't do that, even if it was passed using the wrong "bind" function (if that is even possible). Perhaps a PHP forum might shed some light on it.