> You don't want to start looking for possible SQL injection vectors once you know someone is targeting you. Except that SQL injection vectors are only conside

> You don't want to start looking for possible SQL injection vectors once you know someone is targeting you. Except that SQL injection vectors are only considered an obvious threat for your example, because the associated concrete adversary is already well-known to everyone here. The point is that without a realistic threat model, you have no idea where to draw the line. If you plan to try and anticipate every possible threat (because who knows if your app's data will be targeted by The Russians next week) then just unplug your hosting servers and put them in a locked room.