not use databases, or aren't web accessible. SQL injection
vulnerabilities are not web-specific, but it seems that they are
rarely reported for non-web applications, so it is possible that
this reflects some researcher bias.