...
The answer is: Data being treated as an instruction.
Solution: Separate them so that data can never be interpreted as an instruction!
In SQLi, this solution is to use parameterized queries. You send the query in one packet, then the parameters in a second one. SQLi is thus prevented.
(Not that SQLi is the only vulnerability possible.)
So, yes, total agreement there. Parameterized queries are key. I find it crazy that anything else ever existed, let alone still gets used.
Most people don't realize how much these vulnerabilities have in common, in the abstract, until you frame it like that.
...
The answer is: Data being treated as an instruction.
Solution: Separate them so that data can never be interpreted as an instruction!
In SQLi, this solution is to use parameterized queries. You send the query in one packet, then the parameters in a second one. SQLi is thus prevented.
(Not that SQLi is the only vulnerability possible.)