It might have been an insanely old application that predates SQL injection being common knowledge (or required to be protected against) and has been forgotten about/poorly maintained.

There are oodles and oodles of apps like this powering our daily lives.