There are many fixes. The problem is that way too many programmers still aren't aware of the problem, or think that a simple string replace is going to solve it. Don't worry, the computer industry is full of things that have been solved forty years ago but people are only noticing now :) Computer security is very complex overall, though.

Ugh, now please don't ask why default credentials or buffer overflows are still around..

Why did so many people use to smoke in bed, even though houses kept burning down? Why do so many people drive without a seat belt? Bicycle without a helmet?

Just 17 years old? There was no SQLi before 1999? It must have been a happy time...

Actually this questions makes a lot of sense to me. Programming languages, libraries and drivers used to connect to database systems should be designed in such a way that SQL injection vulnerabilities would be almost impossible to exist.

Sometimes, SQLi vulnerability can be seen as a bug in an implementation. And 100% bug-free code is still not generally available, even after 17 years(?!) of SQL.

@RaduMurzea But there are plenty of such libraries. And the databases themselves often have complex security options that give you multi-tiered defense. That doesn't mean that you will always choose those, or even be aware of their existence. It's not like you need a certification to make an application - people simply do what works (or seems to work, most of the time). And while a part of the programming community strives for more managed (safe by default), there's always the other part that strives for less restriction (less overhead, more "power"...).

@RaduMurzea: Agreed - e.g. removing the deprecated mysql library from PHP would be an excellent first step. But then you still have to wait for the older PHP versions to become infeasibly difficult to find/install on any computer system reasonably still in use. That's 10 years away, at least. Also consider that Indian schools still teach their pupils C++ on Turbo C++ from 1989 in a DOS emulator. I'm not kidding. This has to start with education and end with enforcement because, as techraf says, there is no natural selection to do either of those things for us.

@LightnessRacesinOrbit Side note: The deprecated mysql library was actually removed in PHP 7.0...

Weak passwords are 30 years old or more. Why are they still around?

Quite frankly, because of stupid people. The Army has been hacked by SQLi. The freaking army!

@Anders, I might quibble with some of your examples: cycling without a helmet is every bit as justifiable as walking without a helmet -- rate of head injuries is actually higher per mile traversed on foot! (Per minute rather than per mile yields a very different result, but the question is whether one is cycling as transportation -- in which case the total distance which needs to be traversed is presumably fixed -- or as exercise or entertainment, in which case the number of minutes is fixed, to determine which measure is appropriate).

@Anders, ...risk compensation effects, and the effect of compulsary helmet usage on the number of cyclists [and the knock-on effects of this on safety-in-numbers effect, which has been quantified with the accident rate for each individual cyclist dropping by 1/3 each time the population of cyclists in a region doubles] likewise make cycling without a helmet far more justifiable than concatenating values to form SQL queries.

Read Mark Minasi's book, the software conspiracy. It explains crappy software design in detail.

You could ask this about almost anything. Type-safety has been around longer than computing itself, yet people still write code in C. There are languages whose type-system is powerful enough that the property "free from SQL injection" can be expressed as a type, and vulnerable code would simply fail to compile. Yet, webservers and databases are still written in C and web apps in PHP.

SO is 6 years old, but primary opinion based questions with no definite answer are still around. People continue to ask them and sometimes they become unimaginably popular. It strikes me as odd. Why do so many SO question still opinion based? Is there no fix?

@SalvadorDali - few points:

1) This is not SO

2) People are opinion based

3) Some questions, despite being off topic or otherwise not perfectly suited, actually elicit good answers

You are right that this one isn't really suitable here, and if it was voted to close by the community I'd support that, but until then it's not actively damaging the site.

@RoryAlsop the site is still at least 6 years old. People are opinion based, but the rules are that people should not create questions like this. It is not actively damaging the site, but I am sure that it will span many the same kind-of-useless questions like: "password reuse is X years old, why do people reuse password", "phishing is X years old, why do people share their password", "permissions/XSS/misconfiguration/CSRF".

You can even create a generator for these types of questions. But the very best most probably would be "0-day is > 30 years old, why do people still have bugs in their programs"