Parameterised queries
It gives a new attack vector - to introduce additional data into the database, you just need to figure out how to turn a length 1 vector in to a length 2 vector. It's dangerous in the same way that allowing dbGetQuery() to execute multiple queries is dangerous.
I'd rather hope that if it were a case that mattered, the user would not rely on the api as a substitute for appropriate checks.
I think the API should be as safe as possible by default, and sacrificing safety for speed should only be done explicitly when the user asks for it. Hadley