Agreed. Regarding your first paragraph, you could easily substitute Java, PHP, Python, Ruby, etc and it would still be just as valid. I shudder to think just how many web applications are still out there running severely outdated versions of PHP and whose source code hasn't seen a pair of eyeballs in years. I suppose this is one reason why SQL injections are still so pervasive.