What is SQL injection?

It is a way of hacking on a database driven Web site in which the hacker executes unauthorized SQL commands by taking advantage of insecure code on a system connected to the Internet,bypassing the firewall.

SQL injection hackers are used to steal information from a database from which the data would normally not be available and/or to gain access to an organization’s host computers through the computer that is hosting the database.

SQL injection attacks typically are easy to avoid by ensuring that a system has strong input validation.

Example:

This is your query when the user clicks on the Login button ->

Select [UserName], [Password] From Users Where UserID = 1; 

This the Hacker query "he types this query in the user name textbox"->

Select [UserName], [Password] From Users Where UserID = 1;
Drop Table Users;

So Never use a direct query from your Web Application to Database.

Instead use Stored Procedures and Implement Layers such as Data Access Layer and Business Logic Layer, this would protected you against the SQL Injection.

Source: https://www.nilebits.com/blog/2008/11/sql-injection/