> Because not everyone is constantly mindful of SQL injections. I'm a senior developer but just started using SQL seriously a few months ago, and only for my o

> Because not everyone is constantly mindful of SQL injections. I'm a senior developer but just started using SQL seriously a few months ago, and only for my own projects, so don't have much experience; but it's difficult for me to understand this. Both in Python and in Go, every single tutorial tells you how to use parameterized queries, and every answer on StackOverflow has warnings of building SQL queries from normal string operations. Fifteen years ago I could see this being an issue; but is it really possible that in 2019 "inexperienced web developers" manage to write code vulnerable to SQL injection? Is it really only my hard-won paranoia, gained from decades of building operating systems in C, that made me immediately take these warnings to heart? (That's a genuine question, not a rhetorical one.)