A human should defintely be doing that.
By "that" it is understood: enforcing that the code cleans up unsafe inputs before processing them.
If there is no human doing that enforcement, the code has no chance of being secure.
Why! Do you use your eyeballs to spot SQL injection? Or do you maybe use a tool? A linter perhaps?
Why! Do you use your eyeballs to spot SQL injection? Or do you maybe use a tool? A linter perhaps?