Since people rarely refresh their knowledge, even when they know it's old, those links may help realizing that for at least few years there are newer and more secure solutions than old mysql extension:
- http://www.php.net/manual/en/book.pdo.php
- http://www.php.net/manual/en/book.mysqli.php

ext/mysql is deprecated in PHP 5.4 (albeit without actual PHP warnings until PHP 
5.5). Migrating to mysqli or PDO is strongly recommended at this time, and the 
legacy MySQL extension won't be receiving new features.

Are you seriously telling me that PHP created a new MySQL interface without 
dealing with the bad design of the queries?

No, what you are describing is prepared statements which are fully supported in 
both MySQLi and PDO. So the new interfaces do exactly what you propose.

See:

http://www.php.net/manual/en/mysqli.prepare.php
http://www.php.net/manual/en/pdo.prepare.php

Both the ? placeholder style you proposed and the even safer named placeholder 
style are supported:

eg.

$sth = $dbh->prepare('SELECT name, colour, calories
    FROM fruit WHERE calories < ? AND colour = ?');
$sth->execute(array(150, 'red'));

and

$sql = 'SELECT name, colour, calories
    FROM fruit WHERE calories < :calories AND colour = :colour';
$sth = $dbh->prepare($sql);
$sth->execute(array(':calories' => 150, ':colour' => 'red'));

Note that this has been available in PHP since 2005, so it isn't exactly new.