Let's not go so far as to say that I'm paranoid, but I've been spending hour after hour learning how to prevent SQL injections (and XSS for what it's worth).
What I'm wondering is that a SQL injection doesn't seem like it would do permanent harm to my database if I've made daily backups. Doesn't importing yesterday's copy of my tables just restore them and then I can be on my merry way?
As far as actual loss of data goes, you're mostly correct - you'd lose any changes made in the past day, but aside from that you'd be back to a functional database.
However, there are other things that, just because they aren't "lost", doesn't mean it isn't bad that they got compromised. These kinds of things are stuff like user account info (and especially password hashes) - things that people use to protect their accounts and, if discovered by the wrong people, can lead to malicious usage of their information and resources.
That's why you have to work to avoid security breaches in the first place rather than simply rolling back any changes.
Other people have noted that you've partially addressed the issue of data loss (restore from hopefully recent backup) but missed the issue of data theft.
There's another potential issue. Many SQL servers allow you to execute arbitrary system commands (e.g. MS SQL). Others (e.g. MySQL) let you write arbitrary files (see also this article on exploiting MySQL injections). The bottom line is that an SQL injection attack can compromise the whole system, and thence onward. Of course, there are configuration options to disable some of these, but they're real concerns.
If you want recommendations, I suggest PDO with prepared statements.
This is a very dangerous way to think. Yes, SQL injection attacks will usually trash the database and thus instantly crash your web app, after which you (somewhat) merrily restore from backup and go on your (somewhat) merry way.
On the other hand, they may simply blow away or alter a few records at random, so that it takes you weeks or even months to discover that your data have been getting slowly corrupted over a long period of time. Good luck recovering from that.
Worse still, the SQL injection attack might be designed to steal data rather than damage it. An attacker might figure how to get your web site to deliver a bunch of credit card numbers in response to a nominal request to edit their profile.