What is a common mistake when working with SQL injection?

A common mistake with SQL injection is escaping quotes manually or validating only common attack strings is brittle and can be bypassed across different query contexts and database engines. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.