If you make a block and don't override the save method, textfield input is not escaped before being used in the database query to insert/update the record! Just add any basic block -- html, image, youtube, whatever -- and put an apostrophe in the title field (or the main content area for the html block), submit the form -- if you have php errors being displayed it will show that the SQL query failed.

I know this is in the admin section so hopefully the site owners and maintainers aren't trying to run SQL injection attacks on their own sites, but escaping all input before using it in a query should always be performed regardless.