How is SQL Injection real?

What kind of a backwards language do you have to use that doesn't have the simple feature of protecting you from it out of the box? Are you building you queries by concatenating strings like a CS freshman?

>>16
you can wrap your sql query in an nvarchar and then execute that query