SQL injection is a code injection technique, used to attack data driven applications, in which malicious SQL statements are inserted into an entry field for execution.
SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database. Attackers take advantage of the fact that programmers often chain together SQL commands with user-provided parameters, and can therefore embed SQL commands inside these parameters. The result is that the attacker can execute arbitrary SQL queries and/or commands on the backend database server through the Web application.
There is a community wiki on StackOverflow which has some answers to the very common question, "How can I protect myself from SQL injection?" If your question involves PHP and SQL, make sure you have already read this to prevent unnecessary repetition.
An example SQL Injection could be:
"; SELECT credit_cards FROM transactions; --
In which a normal query could transform into malicious code:
SELECT username FROM users WHERE username = "$username";
SELECT username FROM users WHERE username = ""; SELECT credit_cards FROM transactions; --";