The SQL injection analogy is a well chosen comparison. Parameterized queries solved SQL injection by separating data from executable context at the architecture level. We don't have an equivalent primitive for semantic context yet -- which is why the fixes are all heuristic rather than deterministic.