SQL Injection
In plain terms
An attack that sneaks malicious SQL into an app's database queries.
Going deeper
When user input is concatenated into queries unsafely, an attacker can inject commands to read, alter, or destroy data. It's prevented with parameterized queries that separate code from input.
Under the hood
Root cause is mixing code and data; parameterized queries/prepared statements are the fix, with ORMs and least-privilege DB accounts as defense in depth.
Examples
' OR 1=1 -- in a login form; the OWASP #1 risk historically; Bobby Tables.
Think of it like...
Like slipping extra instructions into a fill-in-the-blank form so the clerk unknowingly hands over files they shouldn't.