I don't understand how SQL injection still exists as a problem. Isn't it pretty much completely solved by using an ORM or prepared statements? Is it just laziness that allows it to fester on, or is there something I'm missing?
Prepared statements won't handle variable table names. Thus if your application builds a table name from user-influenced input, you need to do an extra step of sanitization that prepared statements won't do.
It's a combination of laziness, ignorance and a reluctance to migrate/fix legacy code.