SQL injection happens when user input is concatenated into a SQL query instead of being passed as a bound parameter. The input then changes the structure of the query, not just its data.

The classic example

$sql = "SELECT * FROM users
        WHERE username = '" . $_POST['username'] . "'
        AND password = '" . $_POST['password'] . "'";

Send username = administrator'-- and the query becomes:

SELECT * FROM users WHERE username = 'administrator'-- ' AND password = '...'

The password check is commented out. You are logged in as the administrator.

Where to look

• WHERE clauses in search, filter, and login features.
• INSERT / UPDATE values.
• ORDER BY (column name or number — cannot be parameterised in most drivers).
• Table names, LIMIT, and other non-value positions.
• Any input: query string, body, cookies (TrackingId), User-Agent, Referer, JSON fields, XML.

Detection routine

1. Submit a single quote ' and look for an error, a 500, or a changed page.
2. Submit SQL-safe equivalents that should not change the result: '+OR+1=1-- vs '+OR+1=2-- — a difference proves you control the logic.
3. Try arithmetic in numeric contexts: id=3-1 returning product 2.
4. Try a time delay payload (see the blind lesson) as a last resort.