It might have been an insanely old application that predates SQL injection being common knowledge (or required to be protected against) and has been forgotten a

It might have been an insanely old application that predates SQL injection being common knowledge (or required to be protected against) and has been forgotten about/poorly maintained. There are oodles and oodles of apps like this powering our daily lives.