It's trivial to protect against SQL injection. It requires only a bit of discipline to avoid concatenating user data into queries. Anyone still vulnerable at this point is simply incompetent.