The web attacks that refuse to die

SQL injection and XSS attacks should have disappeared long ago. They didn't.