SQL injection vulnerabilities

Via Bruce Schneier:

Michael Sutton apparently did a simple test wherein he found that more than 10% of the sites in his sample were vulnerable to SQL injection.

Interesting.