>SQL injection is super trivial to prevent, right? How are we still falling for this?

Because the bug is super trivial to fix, it's also super trivial to do. Not to mention, the human mind is naturally inclined to not care about trivial stuff, which leads to careless mistakes at many levels and thus Bobby Tables dropped out of school.

In most environments, it’s more effort to interpolate values into queries than to use parameters.

Not only more effort, but also the only way in certain cases as not everything supports parameterization. The IN operator for example is one where we fall back to string interpolation, though not directly with user values.

Huh, no?

Tt's very easy to do it incorrectly.

It's at best equal... unless there is some SQL driver/client somewhere that disallows hardcoded strings everywhere (that would actually really help).

Don't pass interpolated strings to the SQL driver? It seems super easy to do `exec("select * from table where column1=?")` instead of `exec(sprintf("select * from table where column1='%s'", user_data))`. If someone is doing the latter and they're super junior, it's a teachable moment. If they're not super junior I'm wondering what else they're sloppy about and if they need handholding (or worse).

Unfortunately with security exploits, you're looking for the weakest link in a chain of X million people. All you need is one careless dev/analyst and you get compromised

That makes sense, but the aerospace industry seems to be able to solve for sloppy devs. Why can’t we secure our national infrastructure similarly? (To be clear, I don’t think we need aerospace-grade correctness for every piece of DoE software, but surely we can solve for low hanging fruit like “SQL injection attacks”)

That aside, a WAF would have stopped this.

Basically all these file transfer solutions are crap, from a quality and security perspective.

Procurement works by ticking off features of a list, possibly comparing prices. Quality and security are hard to quantify, and often cannot really assessed by the purchase managers themselves, so they don't play a major role in purchasing decisions.

Thus, vendors aren't really incentivized to make robust, reliable and secure software, they are incentivized to sell their software.

You could say that about most of the OWASP Top 10. If the discourse is any way to judge, most web developers are more invested in constantly re-litigating JavaScript framework wars than learning the extremely trivial design patterns that would resolve most of their security issues. Speaking as a penetration tester, the things devs will let go to prod while managing the information of millions of customers is enough to make you lose hope in the concept of digital infrastructure.