Comment by jiggawatts

Parameterised SQL queries would have blocked it outright also.

Parameterised queries however don’t need an annual fee and a team of security engineers to babysit it.