The mere fact that anyone would have to check for SQL injections by anything other than using prepared statements at all is very descriptive of the WordPress ecosystem and the kind of engineering conventions it enables. It’s a sad state of affairs that this terrible insecure mess is the base of so many websites.

„Well it may be terrible but everyone uses WordPress, so I can’t be that bad, eh?“ - wrong. WP was in the right place at the right time, everything else is momentum. Anyone without any qualification sells themes and plugins, and it shows. In the construction industry, there’s a lot of codes and safety regulations to prevent that and ensure proper practices; it’s a shame the software industry doesn’t.