SQL injection was described publicly in 1998. It has been in the OWASP Top Ten since the OWASP Top Ten existed. The fix is well understood, cheap, and built into every database driver in common use.

But but but…. it’s still breaching companies today, 20+ years later

This isn’t a hard vulnerability to understand or an expensive one to fix. The question worth asking isn’t “what is SQL injection”. It’s “why does a solved problem keep shipping to prod”.

Every team solves secrets the same way, in the same order. First they’re in the repo in plaintext, because it’s day one and there’s one API key (but I hope that by now you know better!). Then someone notices, and they move to environment variables set by hand on the server. Then there are four servers and nobody knows which one has the current value. Then it’s a shared password manager, and deploys involve copy-pasting out of it.