A SQL Injection attack is an threat or data attack mechanism used by hackers to steal sensitive information from database.

SQL Injection arises since the fields available for user input allow SQL statements to pass through and query the database directly.

Ex:  Create table tbluser
(
 userName varchar(50) primary key,
 userpwd varchar(50),
 address varchar(100)
 )
insert into tbluser(userName,userpwd,address)values('mohan@gmail.com','123456','Delhi');
insert into tbluser(userName,userpwd,address)values('shailendra@gmail.com','123456','Noida');

Now lets look at the following query string in Asp.net. In this we are passing username from TextBox "txtUserID" and userpwd from TextBox "txtpwd" to check user credential.

 "SELECT * FROM tbluser WHERE userName = '"+ txtUserID.text +"' and userpwd = '"+ txtPwd.text +"'"; 

Now hacker will pass the following input to TextBoxes to inject sql attack. What will happen when the below data goes as input?

"SELECT * FROM tbluser WHERE userName = ';Drop table tblusers --' and userpwd = '123'";