3 possible explanations can be mixed at whatever ratio you like:
1. SQL wasn't tied so closely to the front end
2. SQL queries were written by DBAs originally, and only later directly by web devs
3. Holes aren't always discovered (or disclosed) immediately they exist
Comments
1. SQL wasn't tied so closely to the front end
2. SQL queries were written by DBAs originally, and only later directly by web devs
3. Holes aren't always discovered (or disclosed) immediately they exist