What is it
SQL injection happens when input from a user is concatenated into a database query, so the database interprets part of that input as instructions rather than values.
How it works
An application builds a query by joining strings together, including something the user supplied. The user supplies something that closes the intended value and adds instructions of their own. The database, having no way to tell the difference, executes all of it.
The fix is structural rather than defensive: parameterised queries send the query and the values over separate channels, so user input can never become code.
Why it matters
A successful injection typically means the entire database, and frequently the ability to write files or execute commands on the host.
What can happen
Full disclosure of stored data, modification or destruction of records, authentication bypass, and in many configurations a foothold on the server itself.
How to detect it
Database errors surfacing to users, unusual query patterns or durations, spikes in failed queries, and web server logs containing SQL syntax in parameters.
How to defend
Use parameterised queries everywhere, without exception. Apply least privilege to the database account so an injection cannot reach everything. Validate input against expected shape. Do not surface database errors to users. Add a web application firewall as a second layer, never as the first.