&gt; Consider the case of a typical web dev shop that hires a developer who thinks escaping is a good solution to SQL injection. It might get snuck past code review if you&#x27;re unlucky.
&gt; There are static analysis tools that can identify such problems ... sometimes ... maybe ... depending on the language and frameworks in use.<p>Analysis tools are the wrong approach - that code should be simply impossible if you&#x27;re typing things correctly, and inadequately typed code should be very obvious in code review.<p>&gt; And most devs can&#x27;t simply produce such a tool if there isn&#x27;t one on the market because that&#x27;s not what they&#x27;re being paid to do.<p>Most devs could write such a thing if the company told them to. The reason &quot;that&#x27;s not what they&#x27;re being paid to do&quot; comes down to process.