It isn't always easy to convince even experienced developers that SQL Injection can be a problem. Look at this current thread.

Avoiding injection on stored procedure

http://www.sqlservercentral.com/Forums/Topic678702-8-1.aspx