Pro PHP Security: From Application Security Principles to the Implementation of XSS Defenses, Second Edition

What SQL Injection Is

There is no point to putting data into a database if you never intend to use it; databases are designed to promote the convenient access and manipulation of their data. But the simple act of doing so carries with it the potential for disaster. This is true not so much because you yourself might accidentally delete everything rather than selecting it. Instead, it is that your attempt to accomplish something innocuous could actually be hijacked by someone who substitutes his own destructive commands in place of yours. This act of substitution is called injection.

Every time you solicit user input to construct a database query, you are permitting that user to participate in the construction of a command to the database server. ...