Sql injection

SQL Injection happens when a developer accepts user input that is directly placed ( with out change )
into a SQL Statement and doesn't properly filter out dangerous characters.
This can allow an attacker to not only steal data from your database,
but also modify and delete it. Certain SQL Servers such as Microsoft SQL Server contain
Stored and Extended Procedures (database server functions).
If an attacker can obtain access to these Procedures
it may be possible to compromise the entire machine. Attackers commonly
insert single qoutes into a URL's query string, or into a forms input field to test
for SQL Injection. If an attacker receives an error message like the one below
there is a good chance that the application is vulnerable to SQL Injection.

Ex. admin';delete from USer_Details where User_Id=4--