I see various articles that proclaim means to guard against SQL injection. As individual steps they are of use but since they were often proclaimed as "the solution" they were potentially misleading.

At http://www.simple-talk.com/sql/learn-sql-server/sql-injection-defense-in-depth/ there is an article entitled "SQL Injection: Defense in Depth" - this article argues what I have argued myself.

Remember that however low-grade the information on your web site is, if your site is hacked, the public may percive the hacking as your most sensitive information was exposed.