Because it's easier to write vulnerable code than nonvulnerable code.
If you call the function that should be used on all input that you glue to SQL mysql_escape_string() then you shouldn't wonder why people are not using it.
If I were to design web language then there would be sql string type and literal and all the db functions would take only parametrs of this type. You wouldn't be able to glue strings or anything else to that type without autoconvertion that does the escaping and the only way that you could convert plain string to this type witout escaping would be via function called i_am_stupid_and_i_want_my_server_hacked and it would be buried deep in my package hierarchy if I had one.
Same goes for HTML, JavaScript and maybe even CSS. Separate string type and string literal and same interface between these types and all others.
Comments
Because it's easier to write vulnerable code than nonvulnerable code.
If you call the function that should be used on all input that you glue to SQL mysql_escape_string() then you shouldn't wonder why people are not using it.
If I were to design web language then there would be sql string type and literal and all the db functions would take only parametrs of this type. You wouldn't be able to glue strings or anything else to that type without autoconvertion that does the escaping and the only way that you could convert plain string to this type witout escaping would be via function called i_am_stupid_and_i_want_my_server_hacked and it would be buried deep in my package hierarchy if I had one.
Same goes for HTML, JavaScript and maybe even CSS. Separate string type and string literal and same interface between these types and all others.