Yes this is a database topic, but it is also meant as more of a developer discussion.

Many people seem to either be blithely unaware of the hazards or think they can simply escape quotes in dynamic SQL to avoid the problem instead of using parameterized queries.

It takes some time to read through it but I think it is educational:

SQL Injection Attacks by Example

What do you do to prevent SQL injection problems (both malicious and accidental)?