What is SQL Injection?
User input rewritten as SQL — still a top breach vector.
Attacking an application by putting SQL syntax into input that gets concatenated into a query, letting the attacker read or modify data. The fix is parameterized queries (prepared statements), which every modern ORM and driver supports.
' OR 1=1 -- in a login form bypasses the password check.