The injection query was entered in the UI form. A form is a form.

The problem happened because the backend php code just took that malicious query and ran it.

The database code was written unsafely, the door was left wide open,  I'm suprised it didn't get taken sooner.

It should have been coded using PDO prepared statements.

If they used old school straight sql queries then I would think that many other doors and windows were open. I'll bet the sessions weren't safe from fixation etc.