Assassinations might work to some extent but not really solve the problems. Criminals are opportunists (as any entrepreneur, just different moral view - I hope!) - give them an opportunity and they take it.

Now - who and why thought that executing any code coming from uncontrolled source is a good idea? I have no sympathy (well, almost none) to sites falling in SQL injection attacks or any other which execute any code coming from an uncontrolled source. There would be no need for that except successful marketing, lazy and incompetent site design, and so on. Of course you can't wait uneducated public understanding but how the IT did go to that trap? There is not much we can do if the user allows some malicious code to be installed and then runs it but automating the functionality for bad guys?