As part of my job I test for web application vulnerabilities regularly. When it comes to SQL Injection, my methodology is to start by manually browsing the website and spidering it, then, sending the parameters that I suspect to interact with the Database to SQLMap. 

Now, I'm wondering if this is the right way of looking for SQL Injection? Will SQLMap be able to find most types of SQL Injection or should I resort to manual testing instead?