Dear
If DDS style use of value objects solves the indata validation problem , and if DDS style indata validation does not solve SQL Injection, then there is only one logical conclusion to draw.
SQL Injection is not an indata validation problem. Yes, that might be contrary to popular belief, but it is obviously so.
If not an indata validation problem, what kind of beast is it? And what can we do about it?
Yours
Dan