SQL injection is a problem with well-known solutions, but it still relies on everyone knowing not to do it and not doing it quickly "just to get it working" and accidently leaving it in.