SQL databases are used in many places to store a wide range of information, from product information to customer details. In such circumstances, users may be required to enter information that is then formed into SQL queries. In a poorly implemented system, a malicious user may be able to include additional SQL syntax in their response, allowing them to compromise the SQL database (perhaps by accessing sensitive information, altering it, or simply deleting it).
For example, when asking for a username within a web page, the user could enter the following text:
John; DELETE FROM Orders
If this was used directly to construct the SQL query, we would end up with the following:
SELECT * FROM Users WHERE UserName = John; DELETE FROM CurrentOrders ...
