Experts rebuke programmers who use SQL injection as feature
Programmers who aren't security savvy are coding SQL injection as a feature in some Web applications, putting users at risk when an application goes live or is distributed to affiliates of online advertising networks.
The coding is critical to the way the application runs. The problem is so pervasive that some security vendors, including TippingPoint, ship their intrusion prevention systems (IPS) with SQL injection protection filters disabled by default to avoid breaking applications.