Should the user input be escaped in dynamic SOQL when using binding?

Question

Given the following query:

public List<Account> selectById(Set<String> names)
{
    String query = 'SELECT Id, Name FROM Account WHERE Name IN :names ORDER BY Name';
    List<Account> records = Database.query(query);
    return records;
}

Should the names collection be sanitized in the following query before it gets to the query?

for (String name : names) 
{
    name = String.escapeSingleQuotes(name);
}

Answer 1

The short answer is no. Because you are using a binding there is no possibility for the value to introduce an SOQL injection attack. It is only when you are textually inserting the value into a generated query that you need to do the escaping.