Original link: SQL Injection in 2025: I Still See It Everywhere / Stackademic.
The fundamental problem is that the math is on the side of the attackers for huge code bases - the developers need to do it right every time - the hacker only needs to fine one case where it is not done right. 999 time scorrect code + 1 time incorrect code is a problem.
This articles makes two god points.
Always parameters. But easier sais than done. The H2 database (embedded database for JVM) has a nice feature - put ALLOW_LITERALS=NONE in connection string and all use of literals throws an exception. Configure your application to use H2 with that is a nice test.
ORM does not make *QL injection impossible. Parameters may still be needed!