PostgreSQL: Re-think current PDO::ATTR_EMULATE_PREPARES setting

Problem/Motivation

For performance reasons we currently force PostgreSQL to use emulated prepares:

// Prepared statements are most effective for performance when queries
// are recycled (used several times). However, if they are not re-used,
// prepared statements become inefficient. Since most of Drupal's
// prepared queries are not re-used, it should be faster to emulate
// the preparation than to actually ready statements for re-use. If in
// doubt, reset to FALSE and measure performance.
\PDO::ATTR_EMULATE_PREPARES => TRUE,

But that's a bad idea, because of:

Postgres PDO Driver uses native statement preparation by default. PDO MySQL uses emulated prepares by default. Native prepares are much more robust against SQL injection, so should be used if at all possible.

Proposed resolution

Re-think the current default to emulate prepares. Check if this is still a performance issue in Drupal 8, and if not, revert back to default to make PostgreSQL more robust against SQL injections.

Remaining tasks

?

User interface changes

none

API changes

none