Curing the Vulnerable Parser: Design Patterns for Secure Input Handling (2017) [pdf] (usenix.org)

I am betraying my ignorance with this question, but: On the last page, the authors claim that SQL queries are commonly constructed by concatenating strings. Was this still, in fact, common in 2017? If it was, that's very scary.