Well, I just searched for "salt lake web design", tried three or four sites found on random portfolios, and none of them had an obvious SQL injection. I'm sure it's much, much too common, but I seriously doubt its prevalence constitutes even a simple majority of professional web work.