SQL Injection (SQLI) is a type of attack on web applications, during which an attacker inserts SQL code into input data that is processed by the database server. The main idea is that the attacker modifies the database query, and thus can gain unauthorized access to information or even change or delete data in the database. SQL injection looks something like this:

The attacker inputs SQL code into a web form or URL parameter, which is then sent to the server.

The web application improperly processes the input data and includes it in the SQL query.

The attacker executes SQL code on the database server, which can lead to various consequences. Developers must ensure the application's security, and testers should check all possible (as much as possible) vulnerability scenarios. Regular penetration testing is also a good practice for detecting and preventing vulnerabilities.