SQL injection was described publicly in 1998. It has been in the OWASP Top Ten since the OWASP Top Ten existed. The fix is well understood, cheap, and built into every database driver in common use.
But but but…. it’s still breaching companies today, 20+ years later
This isn’t a hard vulnerability to understand or an expensive one to fix. The question worth asking isn’t “what is SQL injection”. It’s “why does a solved problem keep shipping to prod”.