Discussion on question by Ishan Mathur: SQL injection is 17 years old. Why is it still around?

Because theory of evolution doesn't apply to IT. Those who create insecure systems still procreate.

@Anders, I might quibble with some of your examples: cycling without a helmet is every bit as justifiable as walking without a helmet -- rate of head injuries is actually higher per mile traversed on foot! (Per minute rather than per mile yields a very different result, but the question is whether one is cycling as transportation -- in which case the total distance which needs to be traversed is presumably fixed -- or as exercise or entertainment, in which case the number of minutes is fixed, to determine which measure is appropriate).

@Anders, ...risk compensation effects, and the effect of compulsary helmet usage on the number of cyclists [and the knock-on effects of this on safety-in-numbers effect, which has been quantified with the accident rate for each individual cyclist dropping by 1/3 each time the population of cyclists in a region doubles] likewise make cycling without a helmet far more justifiable than concatenating values to form SQL queries.