I'll chime in here and agree with all the above. 

The risk of actual SQL Injection is quite limited, especially if developers are using proper SQL procedures (Using stored procedures with parameters).  The biggest risk is with the injection of other items, such as script tags as mentioned above.

Even this is a limited issue though as there are times where you MUST allow people to insert this type of code.  For example I use an instance of the Text/HTML module to insert my Google Analytics tracking code, which is an SQL Script.  I think the biggest thing is knowing the open holes in any modules you are using, and keeping the footprint for user input to a limited base to ensure that you are not allowing unauthenticated or non admin users to insert items unfiltered.