It's insane to think that SQL injection is still on the list (and near the top). I wonder if that's really the case for modern websites these days - could this

It's insane to think that SQL injection is still on the list (and near the top). I wonder if that's really the case for modern websites these days - could this list be biased due to legacy code that hasn't been touched in years? In the 90s there were a lot of us who were just starting out and didn't know any better regarding the sql injection thing. Soon enough it became common knowledge that you had to escape everything when constructing a query. Shortly after that every environment ended up with a library so you could just use placeholders and they would do the escaping for you. Granted, 15 years on I still find the occasional developer that is oblivious to this - but it's not like it was 15 years ago when people were saying "have you heard about a thing called sql injection?"