Think of all the money spent combatting SQL injection attacks. Now we apparently have people deploying systems that fundamentally can't distinguish between code

Think of all the money spent combatting SQL injection attacks. Now we apparently have people deploying systems that fundamentally can't distinguish between code and data, and using pants-on-head 1990s tactics to fight "bad" input on a case-by-case basis. The amount of technical debt this will create is mind-boggling.