One of the things that troubles me most about SQL Injection is that is seems it is still very misunderstood.

Is the following psuedo-code vulnerable to SQL Injection?

String SearchTerm = {some user input here, unvalidated and unscrubbed -- uh oh !}
Command C = New Command("SELECT * FROM SomeTable WHERE Description LIKE '%' + @Match + '%'") 
C.Parameters("@Match") = SearchTerm
Return C.Execute()

Also, consider the following T-SQL code as well.  What do you think it will return? 

CREATE TABLE Letters (Letter char(1) primary key)
INSERT INTO Letters (Letter) VALUES ('A')
INSERT INTO Letters (Letter) VALUES ('B')
INSERT INTO Letters (Letter) VALUES ('C')
INSERT INTO Letters (Letter) VALUES ('D')

DECLARE @Letters VARCHAR(10)
SET @Letters = 'A,B,C'
SELECT Letter FROM Letters WHERE Letter IN (@Letters)

It may not seem like it, but there is a very key concept that these two examples share: the difference between code that is executed versus expressions that are evaluated.   The difference is crucial to understanding what SQL Injection is and where and when you should be worried about it (or not). 

(Edit: the red part above was missing from the post initially ... sorry about the confusion.  I also added some green color coding in the psuedo-code to help distinguish string literals from code)