It's both (neither of these are legitimate defences):

I did not know that accessing a website using a SQL string would cause an injection that enabled me to take full admin of the site

and

We sold them a food laced with toxins, they should have known that it was poisonous