Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now
2 of 10 added 273 characters in body

Bob Martin is clearly exaggerating to make his point more clear. But what is his point?

Does he just want people to stop using SQL/Relational Databases because of SQLi attacks?

To my understanding, Martin wants people to stop using SQL, but not relational databases. These are two different things.

SQL is an extremely powerful language, and it is standardized to some degree. It allows to create complex queries is a very comprehensive manner in a readable, understandable fashion. It does not depend another programming language, so it is usable for most application programmers, no matter if they prefer Java, C, C++, C#, Python, Ruby, Javascript, Basic or something else.

However, this power comes for a cost: writing safe SQL queries is harder than writing unsafe ones. A safe API should make it easy to create safe queries "by default". Potentially unsafe ones should need more mental or at least more typing effort. That is IMHO why Martin is ranting against SQL in its current form.

The problem is not new, and there are safer APIs than standard SQL to access a relational database. Unfortunately, I am not aware of any which is as flexible, as standardized, mature, language-independent and also as powerful as SQL. That's why I have some doubts about Martin's suggestion of "not using SQL" as a realistic way of solving the mentioned problems. So read his article as a thought into the right direction, not as a "best practice" you can blindly follow from tomorrow on.