How is SQL Injection real?

What kind of a backwards language do you have to use that doesn't have the simple feature of protecting you from it out of the box? Are you building you queries by concatenating strings like a CS freshman?

>>11
For example for an app which sends sms which lets you configure a view and columns to get number/name etc from.