SQL injection is done on the web and is a result of exploiting poor programming in mostly PHP.