To extend the metaphor of an HTTP request being an ask rather than an action: I would liken SQL injection to asking if you can enter the building by throwing a

To extend the metaphor of an HTTP request being an ask rather than an action: I would liken SQL injection to asking if you can enter the building by throwing a brick through a window. Regardless of the content of the request, the requester knows the requestee doesn't want to receive requests in that fashion. As several other users have pointed out, intent is important (and in the case of a SQL injection, pretty explicit).