Try to understand it from a point of view slightly closer to reality.
There are people out there with varying levels of skill who will attack your web system for many reasons spanning from political, commercial, personal beef reasons, or merely for entertainment reasons.
The reasons are of no consequence at the end of the day. The fact that a web system is vulnerable and has been exploited is the primary issue.
It is the responsibility of the developer to make sure that all inputs are type set, and database calls are prepared correctly.
The responsibility of the web application user is to make sure it is up to date with the latest version of the application software, and the latest versions of any plugins and addons they may also use.
If application users adhered to this rule then application exploitation would be reduced to a bare shadow of its current self.
If you are using an application that has input vulnerabilities that have not been patched by the developers then you can either patch it yourself, or change to an application that is not vulnerable in such manner.
If any user however neglects to keep their applications up to date when there are fixes available, then to be blunt, it is they that are the script kiddie not the attacker.