When a URL looks like that it means it is being rewritten. On an Apache webserver it's accomplished through the htaccess file using mod_rewrite.
Here's an example rewrite:
RewriteRule ^([a-z])-([0-9]).html$ /index.php?page=$1&id=$2 [L]
Any characters other than the ones defined in the regular expression will be filtered out. It's mostly used with GET queries and it provides some protection. But a regular expression that isn't specific enough could let an injection through.
Here's an example vulnerable rewrite:
RewriteRule ^([a-z.*])-([0-9]).html$ /index.php?page=$1&id=$2 [L]
Testing for an SQL injection would look like this:
example.com/cate'gory/1234
Assuming no other form of protection and not using parametrized queries or properly escaping input, that query would alert you of a possible SQL injection.