您是否花费（或应该花费）在没有以Web为中心的应用程序的安全性上花费多少精力？

Suppose the app you are working on is specially designed for a customer to meet a particular 'in-house' need, such as data processing of payroll information. This application will not be distributed publicly and will reside on internal networks only. (Theoretically the internal network should remain 100% secure.) How much effort should a developer spend on IA in this case? Lets say the database is SQL, would you worry about preventing an SQL injection attack in this situation?Suppose the app you are working on is specially