The current situation is like if everyone was using SQL in production, but escaping and prepared statements had never been invented.