I don't really think SQL injection bugs are the main driver. Certainly everyone should be using a query builder that protects them from this (and yes, I know,

I don't really think SQL injection bugs are the main driver. Certainly everyone should be using a query builder that protects them from this (and yes, I know, there are still people who screw this up), but I think the issues with SQL go far beyond that. Personally I would much rather deal with a database table as a collection of objects with various fields in them. In a language with a reasonable collections library, I want to be operating on that data using functional combinators like filter, map, group_by, sort/order_by, etc. That feels much more natural to me than writing out stringly-typed SQL by hand. This is sorta an ORM, but not quite: it's somewhere in between writing raw queries, and using a full-fledged (usually inefficient) ORM. The downside, of course, is that the performance of my queries is at the mercy of whatever the query generator underneath it is doing. But the nice thing is that if I need to optimize a query, I can always bypass the generator and write it by hand. But I wouldn't do that until I've measured things; no reason to prematurely optimize.