What condition creates a SQL injection vulnerability?
Any application that uses a database is automatically vulnerable.
Every URL parameter is an injection vulnerability even if it never reaches SQL.
Suppressing database errors creates SQL injection by itself.
Untrusted input is inserted into SQL in a way that lets it alter the query's structure.