SQL injection is a type of cyber attack that targets websites, web applications, or databases that use SQL (Structured Query Language) for data storage and retrieval. The attack occurs when a malicious actor inserts malicious SQL code into an input field or parameter of a website, which is then improperly processed by the application's backend database.

The vulnerability arises when a web application does not properly validate or sanitize user inputs before using them to construct SQL queries. If the application fails to validate the input correctly, an attacker can manipulate the input in a way that alters the SQL query's intended behavior.

Here's how SQL injection works:

1. User Input: A web application allows user input, such as through a search box, login form, or URL parameter.
2. Malicious Input: The attacker inputs specially crafted SQL code into the input field, such as adding extra SQL commands or comments.
3. Improper Query Construction: The application fails to validate or sanitize the user input, causing it to directly append the malicious SQL code to the database query.
4. Unauthorized Access or Manipulation: The attacker's injected SQL code can bypass authentication, view unauthorized data, modify, or delete records in the database, or execute other undesirable operations.