I wonder how much of this is because of PHP's legacy. For a long, long time, most articles and tutorials on PHP contained glaring examples of SQL injection, no

I wonder how much of this is because of PHP's legacy. For a long, long time, most articles and tutorials on PHP contained glaring examples of SQL injection, not to mention the whole thing with `mysql_string` and `mysql_real_escape_string`, among others, and embedding your DB credentials in the same file that is served to the client. Wordpress still uses and encourages patterns that weren't even considered unusual back in the late 00s. Same deal with phpBB if you want to modify that. I can only imagine that a lot of developers see the coding part of a plugin as a means to an end. You certainly won't see much of that in, say, Laravel.