"An attack technique used to exploit web sites by altering 
backend SQL statements through manipulating application 
input."

SQL Injection happens when a developer accepts user input 
that is directly placed into a SQL Statement and doesn't 
properly filter out dangerous characters. This can allow an 
attacker to not only steal data from your database, but 
also modify and delete it. Certain SQL Servers such as 
Microsoft SQL Server contain Stored and Extended Procedures 
(database server functions). If an attacker can obtain 
access to these Procedures it may be possible to compromise 
the entire machine. Attackers commonly insert single qoutes 
into a URL's query string, or into a forms input field to 
test for SQL Injection. If an attacker receives an error 
message like the one below there is a good chance that the 
application is vulnerable to SQL Injection.