Because it's not a problem.

• When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the directors' warned, fined or locked up for negligence?

• When was the last time a company lost a big contract because their company website login page didn't validate passwords properly?

• When was the last time a qualified regulator/auditor from a professional organisation had to approve and sign off a public facing computer system before it could be put into use?

You would think that "people will die" would be a good enough reason to make buildings with fireproof materials, alarms and good escape routes.It wasn't. We introduced regulation to force non-flammable building materials, fire safe designs with fire breaks, fire alarms.

You might think "people will die" would be a good enough reason to make everyone care about building structural design. It isn't. It just isn't. We have to have regulation to have qualified engineers sign off on building designs, that they be designed and built for specific uses, and when things fail, society takes the engineers to court.

You would think that "people will die" would be a good enough reason to make food processing clean and safe, but it wasn't.

SQL Injection is less obvious, less publicly visible, and has less severity impact, and is in a completely unregulated industry.

Even to companies which do care about it, they can't usefully advertise "No known SQL injection vulnerabilities in our code" as a marketing bullet point anyone cares about. It's not the sort of question customers ask salespeople. It's not a competitive advantage for them, it's a cost, an overhead. Protecting against it makes them less competitive, slower moving, doing more work for the same functionality.

The incentives are all aligned for it to keep existing. So it keeps existing.

Make SQL injection a problem for companies, and they will make it go away.

[Edit: But there's an EU regulation that websites have to warn you if they use cookies. And they do. So regulating public facing computer systems to make them more annoying can come into effect - even if the current regulation is pretty useless.]

Because it's not a problem.

• When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the directors' warned, fined or locked up for negligence?

• When was the last time a company lost a big contract because their company website login page didn't validate passwords properly?

• When was the last time a qualified regulator/auditor from a professional organisation had to approve and sign off a public facing computer system before it could be put into use?

You would think that "people will die" would be a good enough reason to make buildings with fireproof materials, alarms and good escape routes.  It wasn't. We introduced regulation to force non-flammable building materials, fire safe designs with fire breaks, fire alarms.

You might think "people will die" would be a good enough reason to make everyone care about building structural design. It isn't. It just isn't. We have to have regulation to have qualified engineers sign off on building designs, that they be designed and built for specific uses, and when things fail, society takes the engineers to court.

You would think that "people will die" would be a good enough reason to make food processing clean and safe, but it wasn't.

SQL Injection is less obvious, less publicly visible, and has less severity impact, and is in a completely unregulated industry.

Even to companies which do care about it, they can't usefully advertise "No known SQL injection vulnerabilities in our code" as a marketing bullet point anyone cares about. It's not the sort of question customers ask salespeople. It's not a competitive advantage for them, it's a cost, an overhead. Protecting against it makes them less competitive, slower moving, doing more work for the same functionality.

The incentives are all aligned for it to keep existing. So it keeps existing.

Make SQL injection a problem for companies, and they will make it go away.

[Edit: But there's an EU regulation that websites have to warn you if they use cookies. And they do. So regulating public facing computer systems to make them more annoying can come into effect - even if the current regulation is pretty useless.]

Because it's not a problem.

• When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the directors' warned, fined or locked up?

• When was the last time a company lost a big contract because their company website login page didn't validate passwords properly?

• When was the last time a qualified regulator/auditor from a professional organisation had to approve and sign off a public facing computer system before it could be put into use?

You would think that "people will die" would be a good enough reason to make buildings with fireproof materials, alarms and good escape routes.It wasn't. We introduced regulation to force non-flammable building materials, fire safe designs with fire breaks, fire alarms.

You might think "people will die" would be a good enough reason to make everyone care about building structural design. It isn't. It just isn't. We have to have regulation to have qualified engineers sign off on building designs, that they be designed and built for specific uses, and when things fail, society takes the engineers to court.

You would think that "people will die" would be a good enough reason to make food processing clean and safe, but it wasn't.

SQL Injection is less obvious, less publicly visible, and has less severity impact, and is in a completely unregulated industry.

Even to companies which do care about it, they can't usefully advertise "No known SQL injection vulnerabilities in our code" as a marketing bullet point anyone cares about. It's not the sort of question customers ask salespeople. It's not a competitive advantage for them, it's a cost, an overhead. Protecting against it makes them less competitive, slower moving, doing more work for the same functionality.

The incentives are all aligned for it to keep existing. So it keeps existing.

Because it's not a problem.

• When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the directors' warned, fined or locked up for negligence?

• When was the last time a company lost a big contract because their company website login page didn't validate passwords properly?

• When was the last time a qualified regulator/auditor from a professional organisation had to approve and sign off a public facing computer system before it could be put into use?

You would think that "people will die" would be a good enough reason to make buildings with fireproof materials, alarms and good escape routes.It wasn't. We introduced regulation to force non-flammable building materials, fire safe designs with fire breaks, fire alarms.

You might think "people will die" would be a good enough reason to make everyone care about building structural design. It isn't. It just isn't. We have to have regulation to have qualified engineers sign off on building designs, that they be designed and built for specific uses, and when things fail, society takes the engineers to court.

You would think that "people will die" would be a good enough reason to make food processing clean and safe, but it wasn't.

SQL Injection is less obvious, less publicly visible, and has less severity impact, and is in a completely unregulated industry.

Even to companies which do care about it, they can't usefully advertise "No known SQL injection vulnerabilities in our code" as a marketing bullet point anyone cares about. It's not the sort of question customers ask salespeople. It's not a competitive advantage for them, it's a cost, an overhead. Protecting against it makes them less competitive, slower moving, doing more work for the same functionality.

The incentives are all aligned for it to keep existing. So it keeps existing.

Make SQL injection a problem for companies, and they will make it go away.

[Edit: But there's an EU regulation that websites have to warn you if they use cookies. And they do. So regulating public facing computer systems to make them more annoying can come into effect - even if the current regulation is pretty useless.]