> Like buffer overflows, and raw sql, and …

Those are fixable. Prompt injection is not.