SQL injection is done when a user (some read: "hacker") manipulates data being sent to a PHP script, for example, that is later used inside a SQL query. The "injection" is successful if the programmer who created the script didn't properly escape/sanitize incoming data (note that this doesn't just include data from $POST or $GET; some data in $SERVER and all data from $COOKIE is just as easily manipulated to contain whatever the user wishes) before using it inside a SQL query.
There's how it's done. As for how to protect yourself against it, that has been discussed countless times on the board. As for anything else, you'll have to look elsewhere.
Thread closed.
