I am hardly surprised that some of the so-called IT pros are not getting simple design principles right. I can spot many things from a miles away, and I believe that you can too, but there are plenty of people out there designing websites and software who have absolutely no idea what the simplest things are that they need to get right and which ones are vital so that the product functions properly and efficiently.
These days it seems as if anyone can design a website, and the amount of junk out there is pretty unbelievable, even with some large organisations.
At a risk of getting into a large debate about web development, I'd say a rather large part of the problem is that the tutorials are awful and dangerous.
Anyone who has ever developed any web application with database access: Look at the w3schools tutorial for MySQL:
http://www.w3schools.com/php/php_mysql_insert.asp
And have a look at this tutorial *in the official PHP docs* about avoiding MySQL injections:
http://www.php.net/manual/en/security.database.sql-injection.php
Notice that w3schools doesn't teach to use MySQL with parametrised queries (the safe way), but instead has an example that is already vulnerable to MySQL injections.
Notice that the PHP docs has only one vague bullet point buried away near the bottom about using parametrised queries - the best and safest way of preventing injections.
Can you really blame budding web developers if this is what they have to learn from?
But yeah, I've seen an awful lot of terrible things, some of which is inexcusable. But I don't honestly think the number of security vulnerabilities through MySQL injection exploits is all too surprising or inexcusable.
)!