Indeed, SQL injection attacks cannot be fully mitigated by input validation because sometimes dangerous inputs (such as the apostrophe, in the case of SQL) may also be valid inputs (think of an application that asks for a name and someone that has an Irish name that contains this character).