SQL Injection

SQL injection is a way to manipulate the SQL statements used in web applications for querying database. While forming the SQL query, the programmer may directly use the user input without performing any validation.
This opens a door for the attacker to play around with the database present on the target machine. By sending specially crafted user input, the original SQL statement can be manipulated. These attacks are carried out on parameters in URLs, form field values and cookies.

The Example for SQL Injection is as follows

Create Procedure sp_demosqlinject
( @user Varchar(100),
@pass Varchar(100) )
as
Begin
Exec('Select * From Login Where UserName = + @User + And PassWord = + @Pass')
End

what happen when we execute the above procedures with the following input?

Exec sp_demosqlinject 'Sridhar', 123 Delete Login

We Lost our data through this attacks.