[This isn't specifically about Apex, but definitely applies.]

First, if you haven't read about the recently-published SQL exploit vulnerability, you should here:

http://www.computerworld.com/action/article.do?command=viewArticleB...

and David's paper on Lateral SQL Injection is available at:

http://www.databasesecurity.com/dbsec/lateral-sql-injection.pdf

Second, I did a little scouting and found a tutorial from Oracle that explains the vulnerabilities and where you need to guard against them. There's even a little video that steps you through the scenarios and how you should guard against them. Definitely worth the time.

http://st-curriculum.oracle.com/tutorial/SQLInjection/index.htm

Lastly, here's a little graphic from the tutorial that gives you the quick point: