In mid-2008 Microsoft made available three security tools (one developed in conjunction with the HP Web Security Research Group) designed to counter the increasing wave of SQL injection attacks faced by customers running its software. SQL injection attacks were escalating at that point, targeting design flaws in web applications and not vulnerabilities in the web server or in the server operating system. Five months later, security company Symantec revealed that in the underground economy an attack kit designed to perform SQL injection attacks was sold for an average price of $63, but that it could be as cheap as $15, while going as high as $150.

full here