&gt;simply because developers &quot;don&#x27;t like&quot; or rather can be bothered with the wrestling matches needed<p>In all fairness, I&#x27;d say it&#x27;s more like web application security is a huge field (larger than just SQLi) and a developer typically has their hands full wrestling the technologies they use on a daily basis.<p>I am the most senior developer here in a team of 6 and we all know just the most basic facts about SQLi (use stored procedures), XSS (use sanitizing libraries) and it ends right at CRSF. Of the OWASP top 10, we have an eye on the top 4 and I wouldn&#x27;t wager a high bet we have them nailed down.<p>It feels bad, but considering the resources we&#x27;d need to pour into getting one of our better devs trained in all the facets of web app security, it&#x27;s unlikely to change any time soon.